CVE-2025-13835

Vulnerability

Overview

The Arconix Shortcodes plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This affects versions from n/a through 2.1.20.

Exploitation

Details

An attacker must be authenticated with a privileged role (e.g., Contributor or higher) to inject malicious scripts via the vulnerable shortcode functionality. Successful exploitation also requires user interaction, such as a privileged user clicking a crafted link or visiting a manipulated page [1].

Impact

If exploited, an attacker can inject arbitrary HTML and JavaScript payloads that execute when other users (including site visitors) access the affected pages. This can lead to redirects, ad injection, data theft, or further compromise of the site [1].

Mitigation

The vendor has not released a patched version as of the advisory date, but the recommended immediate action is to update the plugin if a fix becomes available. If unable to update, users should consult their hosting provider or web developer for assistance [1].