CVE-2025-22267: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in Bruce Wampler Weaver Themes Shortcode Compatibility plugin affecting versions through 1.0.4. The vulnerability was discovered by researcher 0xd4rk5id3 and was reported on November 29, 2024, with public disclosure occurring on January 18, 2025 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) (NVD).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions up to and including 1.0.4 of the Weaver Themes Shortcode Compatibility plugin (Patchstack).