CVE-2025-13885 is a stored cross-site scripting vulnerability in the Zenost Shortcodes WordPress plugin, affecting all versions up to and including 1.0. The vulnerability allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript via the 'link' and 'target' parameters of the 'button' shortcode. This occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of these parameters. The vulnerability can lead to script execution in the context of users viewing the compromised pages, potentially impacting confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction needed, and scope changed.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject persistent malicious scripts into pages using the vulnerable shortcode parameters. These scripts execute in the browsers of users who view the infected pages, potentially leading to data theft, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires some level of authenticated access, limiting exposure to trusted users with editing rights.

No official patch or fix is currently available for this vulnerability. Users should restrict Contributor-level access to trusted individuals and consider disabling or removing the Zenost Shortcodes plugin until a fix is released. Monitor the vendor's advisory channels for updates regarding remediation. Since this is a stored XSS vulnerability, applying strict input validation or output escaping at the application level could mitigate risk if feasible.