CVE-2025-13989

Name of the Vulnerable Software and Affected Versions WP Dropzone versions prior to 1.1.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the callback shortcode attribute. The application evaluates user-supplied values in this attribute as JavaScript code using the new Function() constructor. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update WP Dropzone to version 1.1.2 or later. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or use the callback attribute in shortcodes.