Stored Cross-Site Scripting in Ird Slider Plugin for WordPress

CVE-2025-9876

What is CVE-2025-9876?

The Ird Slider plugin for WordPress has a vulnerability that allows attackers to exploit the 'irdslider' shortcode for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping for user-supplied attributes, leading to a scenario where authenticated users with contributor-level access can inject malicious scripts into web pages. The resulting scripts execute when other users access those pages, potentially leading to data theft, account compromise, or other malicious activities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References