CVE-2025-11809

Name of the Vulnerable Software and Affected Versions WP-Force Images Download versions up to and including 1.8

Description The WP-Force Images Download plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'wpfid' shortcode. This is caused by inadequate input sanitization and output escaping on the class attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page.

Recommendations Update WP-Force Images Download to a version newer than 1.8.