CVE-2025-0370

The Shortcodes Ultimate plugin for WordPress (vendor: vanokhin) is vulnerable to stored cross-site scripting because it insufficiently sanitizes input and escapes output for the 'src' parameter, affecting all versions through 7.3.3. An authenticated attacker with Contributor-level privileges or higher can embed arbitrary web scripts into pages via a crafted shortcode, and those scripts execute whenever any user views the injected page. Successful exploitation yields limited confidentiality and integrity impact (CVSS 5.4, scoped change) — typically running JavaScript in victims' browsers, which can enable actions such as forcing redirects, injecting content, or performing actions under the viewing user's session. Any WordPress site running the plugin at version 7.3.3 or earlier is affected, with the greatest risk on sites that grant Contributor or higher accounts to less-trusted users. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the EPSS score assigns a 35.6% probability of exploitation within 30 days (98th percentile), indicating elevated risk.

What to do: Update Shortcodes Ultimate to the latest patched release (any version newer than 7.3.3). Until patched, restrict Contributor-level and higher accounts to trusted users and review recently published or edited pages for unexpected scripts or attributes in shortcode 'src' values. Not currently in CISA KEV and no public PoC is known, but monitor for exploitation given the elevated EPSS score.