CVE-2025-0370 is a stored cross-site scripting vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress, specifically in the ‘src’ parameter. This vulnerability allows authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts into pages. The root cause is inadequate sanitization and escaping of input, enabling script injection that executes upon page access. The vulnerability affects all versions up to and including 7.3.3. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity of the affected WordPress site. There is no indication of availability impact. The vulnerability does not require user interaction to be exploited once the malicious content is injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the WP Shortcodes Plugin — Shortcodes Ultimate if feasible. Monitor for plugin updates from gn_themes that address this vulnerability.