Stored Cross-Site Scripting Vulnerability in ThemeLoom Widgets Plugin for WordPress

CVE-2025-9861

What is CVE-2025-9861?

The ThemeLoom Widgets plugin for WordPress contains a serious vulnerability that allows authenticated users with contributor-level access and higher to exploit the 'los_showposts' shortcode. This occurs due to inadequate input sanitization and output escaping of user-provided attributes. As a result, attackers can inject arbitrary JavaScript code that executes whenever legitimate users access affected pages, potentially compromising their data and website integrity. Websites using versions of the plugin up to and including 1.8.5 are at risk.

References