CVE-2025-9861

The ThemeLoom Widgets WordPress plugin (CVE-2025-9861) is affected by a stored cross-site scripting (XSS) vulnerability in the los_showposts shortcode across all versions up to 1.8.5. The issue stems from insufficient input sanitization and output escaping for user-supplied attributes, enabling a...