CVE-2025-6460
Stored XSS in Display During Conditional Shortcode WordPress Plugin
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gabriel_serafini | display_during_conditional_shortcode | to 1.2 (inc) |
| gabriel_serafini | display_during_conditional_shortcode | 1.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-6460 is a Stored Cross-Site Scripting (XSS) vulnerability in the Display During Conditional Shortcode plugin for WordPress. It occurs due to insufficient input sanitization and output escaping of the 'message' parameter in all versions up to and including 1.2. This flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute whenever any user accesses the injected page, potentially compromising user security.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with Contributor-level access or above to inject malicious scripts into your WordPress site pages via the vulnerable plugin. These scripts execute in the context of users visiting the affected pages, potentially leading to unauthorized actions such as stealing user credentials, session hijacking, defacement, or spreading malware. Because the attack is stored, the malicious code persists and affects all users who view the injected content.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves Stored Cross-Site Scripting (XSS) via the 'message' parameter in the Display During Conditional Shortcode WordPress plugin versions up to 1.2. Detection involves identifying if the vulnerable plugin version is installed and if malicious scripts have been injected into pages via the 'message' parameter."}, {'type': 'paragraph', 'content': 'To detect the vulnerability on your system, you can check the installed plugin version and scan for suspicious script injections in the content managed by the plugin.'}, {'type': 'list_item', 'content': 'Check the installed version of the plugin via WP-CLI: `wp plugin list | grep display-during-conditional-shortcode`'}, {'type': 'list_item', 'content': "Search for suspicious script tags or JavaScript code in the database content related to the 'message' parameter, for example using SQL commands or WP-CLI search: `wp search-replace '<script' '' --dry-run` to find injected scripts."}, {'type': 'list_item', 'content': "Review pages or posts that use the [display_during] shortcode with the 'message' parameter for unexpected or malicious scripts."}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, the primary step is to update the Display During Conditional Shortcode plugin to version 1.3 or later, where the vulnerability has been fixed by sanitizing inputs and validating timezones.'}, {'type': 'paragraph', 'content': 'If immediate updating is not possible, restrict Contributor-level and higher users from adding or editing content using the vulnerable shortcode until the update is applied.'}, {'type': 'list_item', 'content': 'Update the plugin to version 1.3 or newer via the WordPress plugin repository or manually.'}, {'type': 'list_item', 'content': "Audit and remove any injected malicious scripts in the 'message' parameter content."}, {'type': 'list_item', 'content': 'Limit user permissions to prevent unauthorized shortcode usage by users with Contributor-level access or above.'}] [1, 3]