CVE-2025-6460 is a stored cross-site scripting vulnerability in the Display During Conditional Shortcode plugin for WordPress, affecting all versions up to and including 1.2. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'message' parameter. This allows authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher access can store malicious scripts via the vulnerable 'message' parameter, leading to execution of arbitrary scripts in the browsers of users who view the affected pages. This can result in partial confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no indication of availability impact. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Contributor-level access to trusted users only and consider disabling or removing the Display During Conditional Shortcode plugin if feasible. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation.