Description
The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-11-11
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Immediate Patch
AI Analysis

Impact

The Preload Current Images plugin for WordPress allows authenticated users with contributor-level access to inject arbitrary JavaScript through the 'complete' attribute of the 'preload_progress_bar' shortcode. Because the plugin does not properly sanitize or escape this input, the injected code is stored in the database and executed whenever a user visits a page containing the shortcode. This stored XSS can be used for session hijacking, data theft, or site defacement.

Affected Systems

WordPress installations employing the mmdeveloper Preload Current Images plugin version 1.3 or earlier. Any site that permits contributors to add or edit content containing the preload_progress_bar shortcode is at risk.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. Attackers must first authenticate with contributor or higher privileges and manipulate the shortcode attribute; no unauthenticated or privileged vector is reported.

Generated by OpenCVE AI on April 21, 2026 at 18:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Preload Current Images plugin to any release newer than 1.3, or uninstall the plugin if it is no longer needed.
  • If no update is available, remove or disable the preload_progress_bar shortcode from all pages and posts, or configure WordPress to allow only administrators to edit content containing this shortcode.
  • Implement a restrictive Content Security Policy (CSP) that blocks inline scripts or use a security plugin that enforces CSP, thereby mitigating the impact of any remaining XSS vectors.

Generated by OpenCVE AI on April 21, 2026 at 18:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Nov 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Nov 2025 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 11 Nov 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Preload Current Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'complete' parameter in the 'preload_progress_bar' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:18:05.994Z

Reserved: 2025-11-03T20:55:34.379Z

Link: CVE-2025-12658

cve-icon Vulnrichment

Updated: 2025-11-14T15:21:05.314Z

cve-icon NVD

Status : Deferred

Published: 2025-11-11T04:15:48.540

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T18:30:27Z

Weaknesses