What is the CVSS score of CVE-2025-7369?

CVE-2025-7369 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-7369

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-07-21 security@wordfence.com

WordPress CSRF XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 21, 2025 - 08:15 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link. In combination with CVE-2025-7354, it leads to Reflected Cross-Site Scripting.

AnalysisAI

Execute arbitrary shortcodes in WordPress sites running WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.2 via Cross-Site Request Forgery targeting site administrators. Unauthenticated attackers can forge requests that bypass nonce validation in the preview function, allowing execution of arbitrary shortcodes if an admin clicks a malicious link. When combined with CVE-2025-7354, this enables Reflected Cross-Site Scripting. EPSS score of 6.1 (moderate CVSS) reflects the UI requirement and need for admin interaction, though real-world risk is elevated due to the attack surface in WordPress admin workflows. No public exploit code or CISA KEV confirmation identified at time of analysis.

Technical ContextAI

The vulnerability stems from missing or incorrect nonce validation (CWE-352: Cross-Site Request Forgery) in the plugin's preview function, which processes shortcodes without verifying the WordPress security token. The affected code resides in the generator.php file at line 339 within the preview endpoint. Nonces in WordPress are cryptographic tokens bound to user sessions and actions; their absence allows an attacker to construct a forged HTTP request that, when initiated by an authenticated admin user, executes arbitrary shortcodes server-side. The plugin processes user-supplied shortcode parameters without adequate CSRF protection, making the preview function a vector for unauthorized shortcode execution. Shortcodes in WordPress are a templating mechanism that expands to dynamic content; malicious shortcodes can trigger embedded code execution depending on the shortcode handler implementation.

Affected ProductsAI

WP Shortcodes Plugin - Shortcodes Ultimate for WordPress is vulnerable in all versions up to and including 7.4.2. The affected product is typically installed via the WordPress plugin repository. According to the WordPress Trac browser reference and changeset 3328729, the vulnerability exists in the core generator.php file used across the affected version range. Organizations running any version of this plugin at or below 7.4.2 should be considered in scope. The exact CPE for this WordPress plugin would be cpe:2.4:a:vladvader:shortcodes_ultimate:*:*:*:*:*:wordpress:*:*.

RemediationAI

The primary remediation is to upgrade WP Shortcodes Plugin - Shortcodes Ultimate to a patched version beyond 7.4.2. Vendors typically release security updates on the WordPress plugin repository; site administrators should navigate to Plugins → Installed Plugins in their WordPress dashboard, locate Shortcodes Ultimate, and install any available update. Per the WordPress Trac changeset 3328729 reference, the upstream fix has been committed. Until patching is possible, as a temporary mitigation, site administrators can disable the shortcodes preview function or restrict access to the plugin settings to trusted users only, though this may impact plugin functionality. For detailed remediation guidance and to confirm the exact patched version, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5934d1c8-1553-4908-aaab-89d2189eb4cd and the CleanTalk research at https://research.cleantalk.org/cve-2025-7369/.