CVE-2025-7957 is a stored cross-site scripting vulnerability in the ShortcodeHub – MultiPurpose Shortcode Builder WordPress plugin. It affects all versions up to 1.7.1 due to improper neutralization of input in the 'author_link_target' parameter. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This vulnerability allows for potential information disclosure and session hijacking but does not impact availability. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity level. No patch or remediation details have been provided by the vendor or other authoritative sources.

Successful exploitation allows authenticated users with Contributor or higher privileges to inject and store malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or unauthorized actions performed on behalf of users. There is no impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit Contributor-level access to trusted users only. Consider applying web application firewall (WAF) rules to detect and block suspicious input targeting the 'author_link_target' parameter. Monitor plugin updates from the vendor for a forthcoming patch.