CVE-2025-13843

Name of the Vulnerable Software and Affected Versions VigLink SpotLight By ShortCode versions prior to 1.0.b

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the float parameter of the 'spotlight' shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update VigLink SpotLight By ShortCode to a version later than 1.0.a. Avoid using the float parameter in the 'spotlight' shortcode until the update is applied.