Stored Cross-Site Scripting Vulnerability in Mikado Core Plugin for WordPress

CVE-2025-9058

What is CVE-2025-9058?

The Mikado Core plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the manipulation of shortcodes. This issue is present in versions 1.5.2 and earlier, caused by inadequate input sanitization and output escaping on attributes provided by users. As a result, authenticated attackers with permissions at the contributor level or higher can inject arbitrary scripts into the pages that will execute in the browsers of users accessing those pages, potentially leading to unauthorized actions or data theft.

References