CVE-2025-5535 is a stored cross-site scripting vulnerability in the e.nigma buttons WordPress plugin (versions up to 1.1.3). It stems from improper neutralization of input during web page generation (CWE-79) in the plugin's 'button' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts via insufficiently sanitized shortcode attributes. These scripts execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity with network attack vector and low complexity.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or performing unauthorized actions within the context of the affected site. The vulnerability does not impact availability and requires authenticated access, but no user interaction is needed for script execution once the page is loaded.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the e.nigma buttons plugin to prevent exploitation. Monitor for updates from the vendor or WordPress plugin repository regarding a security update addressing this vulnerability.