Stored Cross-Site Scripting Vulnerability in Uncode Core Plugin for WordPress

CVE-2025-6944

What is CVE-2025-6944?

The Uncode Core plugin for WordPress is impacted by a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. This vulnerability specifically affects the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes. Authenticated users with contributor-level access or higher can exploit this issue to inject malicious web scripts into pages. These scripts will execute in the browsers of users accessing the compromised pages, putting their data at risk. Website administrators are urged to restrict access and ensure the plugin is updated to safeguard against this exploit.

References