CVE-2025-13835

MediumCVSS 6.5

Published: 01/12/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Arconix Shortcodes plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions up to and including 2.1.20.

Risk Assessment

An attacker could execute malicious scripts in a user's browser, potentially leading to session theft or content modification.

Recommendation

Update the Arconix Shortcodes plugin to a version higher than 2.1.20. Apply the principle of least privilege.

Other vulnerabilities in Arconix Shortcodes

CVE-2025-66085Medium
The Arconix Shortcodes plugin for WordPress contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.1.18.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.20.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS