Stored Cross-Site Scripting in Auto Bulb Finder Plugin for WordPress

CVE-2025-9858

What is CVE-2025-9858?

The Auto Bulb Finder plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to exploit stored cross-site scripting (XSS) attacks. This issue arises due to inadequate input sanitization and output escaping on the 'abf_vehicle' shortcode, enabling attackers to inject harmful scripts into web pages. When users access these compromised pages, the malicious scripts are executed, potentially compromising user data and site integrity.

References