Stored Cross-Site Scripting Vulnerability in Productive Style Plugin for WordPress
CVE-2025-8394
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 September 2025
What is CVE-2025-8394?
The Productive Style plugin for WordPress suffers from a Stored Cross-Site Scripting flaw, specifically through the display_productive_breadcrumb shortcode. This vulnerability arises due to inadequate input sanitization and output escaping of user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts. When users visit pages with these scripts, they may execute unexpectedly, compromising user data and site integrity.
Affected Version(s)
Productive Style – Optimisations & Content Publishing Support * <= 1.1.23