CVE-2025-15486 Details

A stored cross-site scripting vulnerability has been identified in the Kunze Law plugin for WordPress, affecting all versions through 2.1. The issue arises because the plugin's shortcode fetches HTML content from a remote server and injects it into pages without proper sanitization or escaping. This vulnerability allows authenticated attackers with Administrator-level access to inject arbitrary scripts into pages, which are executed when users access the affected pages. The vulnerability is present in multi-site installations where unfiltered_html has been disabled. Additionally, a path traversal vulnerability in the shortcode name could be exploited to write malicious HTML files to arbitrary writable locations on the server.