CVE-2025-13967

Name of the Vulnerable Software and Affected Versions Woodpecker for WordPress plugin versions up to and including 3.0.4

Description The Woodpecker for WordPress plugin is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the form name parameter of the [woodpecker-connector] shortcode. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page. The vulnerable parameter is form name. The API endpoint is [woodpecker-connector].

Recommendations Versions prior to 3.0.5 should be updated.