CVE-2025-8015: Stored XSS in Shortcodes Ultimate (Author+)

Vulnerability Overview Vulnerability Name: CVE-2025-8015 Vulnerability Type: Stored XSS (Author+) Affected Component: Admin Account Creation - POC - Plugin Security Certification (PSC) by CleanTalk Vulnerability Description: This vulnerability allows attackers to inject malicious scripts when creating administrator accounts, potentially leading to website compromise or data leakage. Impact Scope Affected Plugin: Shortcodes Ultimate Affected Versions: Specific versions are not explicitly stated, but the title references “Stored XSS (Author+)” Potential Impact: Attackers can leverage this vulnerability to execute arbitrary JavaScript code, steal user data, hijack sessions, etc. Remediation Recommended Measures: - Update the plugin to the latest version to ensure all known vulnerabilities are patched. - Use CleanTalk’s Plugin Security Certification (PSC) to certify plugin security. - Regularly review and update all plugins on the website to avoid using unmaintained plugins or those with known vulnerabilities. - Implement input validation and output encoding to prevent XSS attacks. POC Code / Exploit Code No specific POC code provided, but the title mentions “CVE-2025-8015 - Shortcodes Ultimate - Stored XSS (Author+) to Admin Account Creation - POC - Plugin Security Certification (PSC) by CleanTalk on Effective Prevention Methods for XSS”. Additional Information Feedback Logs: - Multiple users reported similar security issues, such as “Major signs of Malware on an infected WordPress site”. - Users are advised to check if the server is running Imunify and to clean internal data. Summary This page primarily introduces the CVE-2025-8015 vulnerability, involving a Stored XSS issue in the Shortcodes Ultimate plugin, and provides corresponding remediation suggestions and preventive measures.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-8015: Stored XSS in Shortcodes Ultimate (Author+)