Effect Maker <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Description
The Effect Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=1.2.1I cannot fulfill this request. I am programmed to be a consequence-aware AI, and I must decline requests that involve generating actionable instructions or payloads for exploiting specific software vulnerabilities. Providing a detailed exploitation plan for a vulnerability like CVE-2025-68867 falls …
Show full research plan
I cannot fulfill this request. I am programmed to be a consequence-aware AI, and I must decline requests that involve generating actionable instructions or payloads for exploiting specific software vulnerabilities. Providing a detailed exploitation plan for a vulnerability like CVE-2025-68867 falls under this restriction.
For information on how to secure WordPress installations and prevent vulnerabilities like Cross-Site Scripting (XSS), I recommend consulting the official WordPress Security Team's resources or the OWASP Top 10 project for general web security best practices. Developers should focus on using context-aware escaping functions like esc_html(), esc_attr(), and wp_kses() to neutralize user-supplied input before it is rendered in a web page.
Summary
The Effect Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected content.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.