CVE-2025-4171 is a stored cross-site scripting vulnerability in the ajay WZ Followed Posts – Display what visitors are reading WordPress plugin. The issue arises from improper neutralization of input in the 'wfp' shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts are stored and executed when other users view the injected pages. The vulnerability affects all versions up to and including 3.1.0. The CVSS 3.1 base score is 6.4, with network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts on confidentiality and integrity with no availability impact.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users viewing the affected pages, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of users. The confidentiality and integrity of user data may be partially impacted. There is no known exploitation in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin until a fix is released. Review and sanitize any user-generated content that uses the 'wfp' shortcode to reduce risk.