Cross-site Scripting Vulnerability in JSM File Get Contents Shortcode Plugin
CVE-2025-58653

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Jsm File Get Contents() Shortcode
Vendor
CVE Published:
22 September 2025

What is CVE-2025-58653?

A Cross-site Scripting (XSS) vulnerability exists in the JSM file_get_contents() Shortcode, where improper neutralization of input during web page generation enables the storage and execution of malicious scripts. This vulnerability impacts versions of the plugin up to 2.7.1, potentially allowing attackers to inject harmful code into web pages viewed by unsuspecting users. Implementing security measures, such as user input validation and sanitization, can help mitigate the risks associated with this flaw.

Affected Version(s)

JSM file_get_contents() Shortcode <= 2.7.1

References

https://patchstack.com/database/wordpress/plugin/wp-file-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

권민성 (Patchstack Alliance)
JSON
.