PT-2025-13738 · WordPress · Wp Date/Time Shortcode

Peter Thaleikis · Publicado 2025-03-31 · Atualizado 2025-03-31 · CVE-2025-31590

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Date and Time Shortcode versions 2.6.7 and earlier

Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting (XSS). This means that an attacker can inject malicious scripts into the webpage, potentially leading to unauthorized access or other malicious activities. The estimated number of potentially affected devices worldwide is not available.

Recommendations For WP Date and Time Shortcode version 2.6.7 and earlier, update to a version later than 2.6.7 to resolve the issue. As a temporary workaround, consider disabling the WP Date and Time Shortcode until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-31590

Produtos afetados

Wp Date/Time Shortcode

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-31590 · Nota de Segurança
• https://patchstack.com/database/wordpress/plugin/wp-date-and-time-shortcode/vulnerability/wordpress-wp-date-and-time-shortcode-plugin-2-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://patchstack.com/database/Wordpress/Plugin/wp-date-and-time-shortcode/vulnerability/wordpress-wp-date-and-time-shortcode-plugin-2-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota