Stored Cross-Site Scripting Vulnerability in ThemeLoom Widgets Plugin for WordPress

CVE-2025-9861

What is CVE-2025-9861?

The ThemeLoom Widgets plugin for WordPress contains a serious vulnerability that allows authenticated users with contributor-level access and higher to exploit the 'los_showposts' shortcode. This occurs due to inadequate input sanitization and output escaping of user-provided attributes. As a result, attackers can inject arbitrary JavaScript code that executes whenever legitimate users access affected pages, potentially compromising their data and website integrity. Websites using versions of the plugin up to and including 1.8.5 are at risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References