CVE-2025-7354 is a stored cross-site scripting vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress, affecting all versions up to and including 7.4.2. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically due to insufficient sanitization and escaping of user-supplied shortcode attributes. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code into pages, which executes when those pages are accessed by other users. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts confidentiality and integrity with no impact on availability. No patch or official fix has been documented in the provided data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into WordPress pages via shortcode attributes. These scripts execute in the context of users viewing the infected pages, potentially leading to unauthorized actions or data exposure limited to confidentiality and integrity impacts. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Monitor for plugin updates from gn_themes and apply any official patches promptly once released. Avoid using untrusted shortcode inputs or disable the plugin if possible as a temporary measure.