CVE-2025-9061: 
WordPress vulnerability analysis and mitigation

The Wilmer Core plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.4.5. The vulnerability was discovered by István Márton and was assigned CVE-2025-9061. This security issue affects WordPress installations using the Wilmer Core plugin and has been rated as medium severity with a CVSS score of 6.4 (Tenable CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in shortcodes. This security flaw allows authenticated users with contributor-level permissions or higher to inject arbitrary web scripts into pages. The injected scripts will execute whenever a user accesses the compromised page (Tenable CVE).

When successfully exploited, this vulnerability allows authenticated attackers to store and execute malicious JavaScript code on affected WordPress sites. When other users, including administrators, view the compromised pages, the stored malicious scripts will execute in their browsers, potentially leading to session hijacking, credential theft, or other client-side attacks (Tenable CVE).