Stored Cross-Site Scripting Vulnerability in WP Shortcodes Plugin by WordPress
CVE-2025-5567
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 July 2025
What is CVE-2025-5567?
The WP Shortcodes Plugin, specifically the Shortcodes Ultimate extension for WordPress, is susceptible to Stored Cross-Site Scripting due to a lack of proper input validation and output encoding on the 'data-url' DOM element attribute. Authenticated attackers with at least Contributor-level access can exploit this flaw, allowing them to inject arbitrary JavaScript code into web pages. When users access these compromised pages, the malicious scripts will execute, potentially leading to unauthorized actions or the exposure of sensitive information. This vulnerability affects all versions of the plugin up to and including 7.4.0.