CVE-2025-58683

The Last Updated Shortcode plugin for WordPress (versions up to 1.0.1) suffers from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during shortcode output. This allows an attacker to inject arbitrary web scripts or HTML that will be stored and executed whenever a user views the affected page [1].

Exploitation requires the attacker to have at least contributor-level access to the WordPress site. The attacker can craft a shortcode containing malicious JavaScript, which is then executed in the browsers of other users, including administrators and visitors [1].

Successful exploitation enables the attacker to perform actions such as injecting redirects, displaying advertisements, or stealing session cookies, potentially leading to further compromise [1].

The vendor has not released a patched version; users are advised to update the plugin as soon as a fix becomes available. As a workaround, consider removing or disabling the plugin until an update is applied [1].