Stored Cross-Site Scripting in Ird Slider Plugin for WordPress

CVE-2025-9876

What is CVE-2025-9876?

The Ird Slider plugin for WordPress has a vulnerability that allows attackers to exploit the 'irdslider' shortcode for Stored Cross-Site Scripting. This issue arises from inadequate input sanitization and output escaping for user-supplied attributes, leading to a scenario where authenticated users with contributor-level access can inject malicious scripts into web pages. The resulting scripts execute when other users access those pages, potentially leading to data theft, account compromise, or other malicious activities.

References