Stored Cross-Site Scripting in Ova Advent Plugin for WordPress

CVE-2025-8561

What is CVE-2025-8561?

The Ova Advent plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping for user-supplied attributes within its shortcodes. This flaw allows authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages, leading to potential exploitation when other users interact with the compromised pages.

References