Stored Cross-Site Scripting in Inline Stock Quotes Plugin for WordPress

CVE-2025-8688

What is CVE-2025-8688?

The Inline Stock Quotes plugin for WordPress is susceptible to Stored Cross-Site Scripting due to poor input sanitization and output escaping on user-supplied attributes within the stock shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts execute automatically when users access the compromised page, potentially compromising sensitive user data and site integrity.

References