CVE-2025-1560 is a stored cross-site scripting vulnerability in the WOW Entrance Effects (WEE!) WordPress plugin, affecting all versions up to 0.1. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's 'wee' shortcode. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows authenticated users with contributor-level access or above to inject and store malicious scripts that execute in the browsers of users who view the affected pages. This can lead to unauthorized actions performed in the context of the victim's session, potentially compromising confidentiality and integrity of user data within the WordPress site. There is no reported impact on availability. The vulnerability does not affect unauthenticated users directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WOW Entrance Effects (WEE!) plugin if possible. Monitor for updates from the plugin vendor or WordPress security channels for patches addressing this vulnerability.