Stored Cross-Site Scripting Vulnerability in Embed Bokun Plugin for WordPress

CVE-2025-6221

What is CVE-2025-6221?

The Embed Bokun plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the handling of the 'align' parameter. As a result, authenticated users with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute whenever other users access the compromised pages, potentially leading to unauthorized actions and data exposure.

References