CVE-2025-23896

WordPress Mindmeister Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 16, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thom4 Mindmeister Shortcode mindmeister-shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through <= 1.0.

Analysis

AI-generated

Technical impact

The Mindmeister Shortcode plugin does not properly neutralize user input during web page generation, allowing an attacker to inject malicious JavaScript that is executed in the context of the victim’s browser. This DOM‑based XSS enables execution of malicious scripts in the victim’s browser.

Affected Systems

WordPress sites that have installed the Mindmeister Shortcode plugin by thom4, including all releases up to and including 1.0. Any instance of this plugin running on a WordPress installation is vulnerable.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.5, indicating moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the current environment. It is not listed in the CISA KEV catalog. The attack is client‑side and can be triggered by a visitor who loads content that incorporates the vulnerable shortcode, making it exploitable through normal website traffic.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mindmeister Shortcode to the latest available version that removes the XSS flaw.
  • If no update exists, uninstall or disable the plugin from the WordPress installation.
  • As a temporary measure, restrict the use of the plugin’s shortcodes to content from trusted authors and apply additional input sanitization on shortcode parameters to prevent injection.

Generated by OpenCVE AI on May 2, 2026 at 06:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3514 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oncle Tom Mindmeister Shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through 1.0.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oncle Tom Mindmeister Shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through 1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thom4 Mindmeister Shortcode mindmeister-shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through <= 1.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oncle Tom Mindmeister Shortcode allows DOM-Based XSS.This issue affects Mindmeister Shortcode: from n/a through 1.0.
Title WordPress Mindmeister Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 10:43 PM
Reserved
Jan 16, 2025, 11:31 AM

View source JSON

Updated
Jan 17, 2025, 5:16 PM

JSON

Status
Deferred
Published
Jan 16, 2025, 9:15 PM
Modified
Jun 17, 2026, 8:57 AM

View source JSON

No data.

Updated
May 2, 2026, 6:15 AM

JSON