CVE-2025-13840

Name of the Vulnerable Software and Affected Versions BUKAZU Search widget plugin for WordPress versions prior to 3.3.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the shortcode parameter of the bukazu search shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update the plugin to a version newer than 3.3.2. Restrict the use of the shortcode parameter in the bukazu search shortcode to users with higher privilege levels to minimize the risk of exploitation.