CVE-2025-66085

MediumCVSS 4.3

Published: 21/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Arconix Shortcodes plugin for WordPress contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.1.18.

Risk Assessment

An attacker may gain access to functions or data that should be protected, potentially leading to unauthorized changes on the site.

Recommendation

Update the Arconix Shortcodes plugin to a version later than 2.1.18 or review and correct the access control configuration.

Other vulnerabilities in Arconix Shortcodes

CVE-2025-13835Medium
The Arconix Shortcodes plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions up to and including 2.1.20.

Original NVD description (English source)

Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through <= 2.1.18.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS