Stored Cross-Site Scripting Vulnerability in EZ SQL Reports Shortcode Widget by WordPress

CVE-2025-6462

What is CVE-2025-6462?

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to stored cross-site scripting (XSS) attacks due to inadequate input validation and output encoding for user-supplied attributes in the SQLREPORT shortcode. This vulnerability can be exploited by authenticated users with at least contributor-level access, allowing them to inject malicious scripts that will execute when other users visit the affected pages. The vulnerability exists in all versions up to and including 5.25.11, highlighting the critical need for proper sanitization practices to protect user interactions within the application.

References