CVE-2025-7957: 
WordPress vulnerability analysis and mitigation

The ShortcodeHub WordPress plugin (versions up to 1.7.1) contains a Stored Cross-Site Scripting vulnerability identified as CVE-2025-7957. The vulnerability was discovered on August 22, 2025, and publicly disclosed on August 23, 2025. The security flaw affects the 'authorlinktarget' parameter in the plugin, impacting WordPress installations using the vulnerable versions (NVD CVE, Wordfence Intel).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability stems from insufficient input sanitization and output escaping in the 'authorlinktarget' parameter (NVD CVE).

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized data access or manipulation of user sessions (NVD CVE).

The plugin has been temporarily closed as of August 21, 2025, pending a full security review. Users are advised to disable the plugin until a patched version is released (WordPress Plugin).