Stored Cross-Site Scripting Vulnerability in WP Shortcodes Plugin by Wordpress

CVE-2025-8015

What is CVE-2025-8015?

The WP Shortcodes Plugin's Shortcodes Ultimate variant is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping within the 'Title' and 'Slide link' fields for uploaded images. This vulnerability allows authenticated attackers with Author-level access or higher to inject malicious web scripts that execute on user access to compromised pages. All versions up to and including 7.4.2 are impacted, highlighting the critical need for updates and increased security measures.

References