CVE-2025-0370: 
WordPress vulnerability analysis and mitigation

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-0370) affecting versions up to and including 7.3.3. The vulnerability exists in the 'src' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 5.4 (Medium) according to NVD, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L). The vulnerability exists in the 'src' parameter of the plugin where input validation and output escaping are insufficient (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack can be executed remotely through the network with low complexity, making it relatively straightforward for attackers to exploit if they have the necessary access level (NVD).

The vulnerability has been patched in version 7.3.4 of the WP Shortcodes Plugin — Shortcodes Ultimate. Users are advised to update to this version or later to mitigate the security risk (WordPress Plugin).