Stored Cross-Site Scripting in WP Shortcodes Plugin by WordPress
CVE-2025-7354
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 July 2025
What is CVE-2025-7354?
The Shortcodes Ultimate plugin for WordPress is at risk of Stored Cross-Site Scripting due to inadequate input sanitization and output escaping of user-supplied attributes in its shortcodes. This vulnerability enables authenticated attackers, with at least contributor-level access, to inject malicious web scripts. Such scripts could be executed on pages viewed by other users, potentially compromising website security and user data whenever an impacted page is accessed.
Affected Version(s)
WP Shortcodes Plugin — Shortcodes Ultimate * <= 7.4.2