CVE-2025-11763

Name of the Vulnerable Software and Affected Versions Display Pages Shortcode plugin for WordPress versions up to and including 1.1

Description The software contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. An attacker with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. The issue is related to the column count parameter within the '[display-pages]' shortcode.

Recommendations Update the Display Pages Shortcode plugin to a version newer than 1.1.