CVE-2025-24673: 
WordPress vulnerability analysis and mitigation

The Ketchup Shortcodes WordPress plugin was found to contain a Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-24673. The vulnerability affects versions up to and including 0.1.2, and was discovered by researcher zaim. The issue was publicly disclosed on January 24, 2025, with a fix released in version 0.2.1 (WPScan, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, stemming from insufficient input sanitization and output escaping in the plugin. It has been assigned a CVSS score of 6.4-6.5 (Medium/Low severity) and is categorized under OWASP Top 10 A3: Injection and CWE-79 (WPScan, Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

Users are advised to update to version 0.2.1 or later of the Ketchup Shortcodes plugin to address this vulnerability. The issue has been fixed in this version, and updating is the recommended solution for all affected installations (Patchstack).