CVE-2025-13885

Name of the Vulnerable Software and Affected Versions Zenost Shortcodes versions prior to 1.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages via the link and target parameters within the button shortcode. These scripts execute whenever a user visits the affected page.

Recommendations Update Zenost Shortcodes to a version later than 1.0. As a temporary mitigation, restrict the use of the button shortcode or limit user permissions to prevent Contributor-level users from editing pages.