CVE-2025-13856

creationtimestamp| type| source ---|---|--- 2025-12-06 10:08:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7cqyeroqb2q...

CVE-2025-13856 Extra Post Images <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Extra Post Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the extra-images shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...