CVE-2025-48087

MediumCVSS 6.5

Published: 17/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through 1.4.1.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session theft, credential theft, or other sensitive information disclosure.

Recommendation

Update the Memberlite Shortcodes plugin to a version newer than 1.4.1. Apply proper input sanitization and validation mechanisms.

Other vulnerabilities in Memberlite Shortcodes

CVE-2025-10125Medium
The Memberlite Shortcodes plugin for WordPress (all versions up to and including 1.4) is vulnerable to stored Cross-Site Scripting via the 'row' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS