CVE-2025-9061 is a stored cross-site scripting vulnerability in the Wilmer Core WordPress plugin by Mikado Themes. It affects versions up to 2.4.5 due to insufficient input sanitization and output escaping on shortcode attributes. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with network attack vector, low attack complexity, and no user interaction required. No patch or vendor advisory is currently provided.

Successful exploitation allows an authenticated contributor or higher user to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Wilmer Core plugin if possible to prevent exploitation.