Stored XSS in Aparat Video Shortcode Plugin by Ali Aghdam
CVE-2025-58876

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Aparat Video Shortcode
Vendor
CVE Published:
5 September 2025

What is CVE-2025-58876?

The Aparat Video Shortcode plugin, developed by Ali Aghdam, contains a vulnerability that allows for Stored Cross-site Scripting (XSS) due to improper validation of user input during web page generation. This flaw can enable attackers to execute malicious scripts within the context of the user's browser, affecting website integrity and user security. The vulnerability is present in all versions of the plugin up to and including version 0.2.4.

Affected Version(s)

Aparat Video Shortcode <= 0.2.4

References

https://patchstack.com/database/wordpress/plugin/aparat-s...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.
CVE-2025-58876 : Stored XSS in Aparat Video Shortcode Plugin by Ali Aghdam