Stored Cross-Site Scripting Vulnerability in FL3R Accessibility Suite Plugin by WordPress

CVE-2025-6689

What is CVE-2025-6689?

The FL3R Accessibility Suite plugin for WordPress contains a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on user-supplied attributes in the fl3raccessibilitysuite shortcode. This flaw allows authenticated users, with contributor-level access or higher, to inject malicious scripts into web pages. These scripts are then executed whenever a user accesses a compromised page, posing a significant risk to the integrity of the website.

References