CVE-2025-5534 is a stored cross-site scripting vulnerability in the ESV Bible Shortcode for WordPress plugin caused by insufficient sanitization and escaping of user input in the 'esv' shortcode attributes. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. The vulnerability affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity. No patch or official remediation has been provided in the data.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to partial disclosure of information and modification of data within the affected WordPress site context. There is no indication of availability impact. The vulnerability does not require user interaction beyond viewing the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the ESV Bible Shortcode plugin if feasible. Monitor for updates from the vendor or WordPress plugin repository for a security update addressing this issue.