Stored Cross-Site Scripting Vulnerability in WP Shortcodes Plugin by Wordpress

CVE-2025-8015

What is CVE-2025-8015?

The WP Shortcodes Plugin's Shortcodes Ultimate variant is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the 'Title' and 'Slide link' fields for uploaded images. This vulnerability allows authenticated attackers with Author-level access or higher to inject malicious web scripts that execute on user access to compromised pages. All versions up to and including 7.4.2 are impacted, highlighting the critical need for updates and increased security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References