{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0370", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-09T22:58:24.363Z", "datePublished": "2025-03-04T09:22:37.463Z", "dateUpdated": "2026-04-08T17:32:15.906Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:32:15.906Z"}, "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "7.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018src\u2019 parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75"}, {"url": "https://wordpress.org/plugins/shortcodes-ultimate/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3229060/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-03-03T20:32:25.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T14:19:22.173400Z", "id": "CVE-2025-0370", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T14:21:01.026Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0370", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T14:19:22.173400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T14:20:17.944Z"}}], "cna": {"title": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "gn_themes", "product": "WP Shortcodes Plugin \u2014 Shortcodes Ultimate", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "7.3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-03T20:32:25.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75"}, {"url": "https://wordpress.org/plugins/shortcodes-ultimate/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3229060/"}], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018src\u2019 parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-04T09:22:37.463Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0370", "state": "PUBLISHED", "dateUpdated": "2025-03-04T14:21:01.026Z", "dateReserved": "2025-01-09T22:58:24.363Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-04T09:22:37.463Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Shortcodes Plugin \u2014 Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018src\u2019 parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-0370", "lastModified": "2025-03-04T10:15:10.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2025-03-04T10:15:10.437", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3229060/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/shortcodes-ultimate/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:59:39.704056+00:00", "value": {"mitigation_remediation": ["Verify the plugin version; if it is 7.3.3 or earlier, consider removing the plugin or disabling its shortcode functionality until an update becomes available.", "Restrict Contributor role\u2019s ability to add the src parameter or remove the capability to add custom shortcodes, using a role\u2011management or security plugin to enforce this restriction.", "Deploy a Content Security Policy that blocks execution of inline scripts originating from the plugin, limiting the impact of XSS until a patch is released."], "summary": {"action": "Apply patch", "impact": "Stored Cross\u2011Site Scripting via src parameter"}, "threat_synthesis": {"affected_systems": "All installations of the Shortcodes Ultimate plugin version 7.3.3 or earlier are affected. This includes any WordPress site that has the plugin from the official repository and has not applied newer releases. The breach can occur in any virtual host where the plugin is active, regardless of platform or site architecture, as the issue is purely in the plugin code.", "description_and_impact": "The vulnerability exists in the WP Shortcodes Plugin \u2014 Shortcodes Ultimate up to version 7.3.3. It allows an authenticated user with Contributor permission or higher to inject arbitrary JavaScript via the src parameter. The injected payload is stored in the plugin\u2019s settings and executes in the browser of any visitor to the affected page, potentially compromising the visitor\u2019s session or enabling phishing attacks. The weakness is an instance of insufficient input sanitization combined with missing output escaping, matching CWE\u201179.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity, and the EPSS of 6% suggests a non\u2011negligible probability of exploitation in the near term. The exploit requires the attacker to be logged in with at least contributor rights, but once authenticated they can inject a malicious payload that will be executed for every page visitor, providing a persistent attack surface. The vulnerability has not yet been reported in the CISA KEV catalog, but its moderate CVSS and moderate EPSS underscore the need for timely remediation."}}}}, "created": "2026-04-22T02:00:05.044193+00:00", "updated": "2026-04-22T02:00:05.044203+00:00", "vendors": []}