JSM file_get_contents() Shortcode <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The JSM file_get_contents() Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...
- CVSS:
- 6.4
- Affected:
- up to 2.7.1
- Fix:
- No patched version reported
- Disclosed:
- Sep 22, 2025
CVE-2025-58653 on NVD →
JSM file_get_contents() Shortcode [wp-file-get-contents] < 2.7.1 (closed)
unknown
[en] The JSM file_get_contents() Shortcode WordPress plugin before 2.7.1 does not validate one of its shortcode's parameters before making a request to it, which could allow users with contributor role and above to perform SSRF attacks.
- Affected:
- up to 2.7.1
- Fixed in:
- 2.7.1
- Disclosed:
- Jan 15, 2024
CVE-2023-6991 on NVD →
JSM file_get_contents() Shortcode <= 2.7.0 - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
medium
The JSM file_get_contents() Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 2.7.0 via the wpfgc shortcode. This makes it possible for authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations originati...
- CVSS:
- 5.4
- Affected:
- up to 2.7.0
- Fixed in:
- 2.7.1
- Disclosed:
- Dec 21, 2023
CVE-2023-6991 on NVD →
JSM file_get_contents() Shortcode [wp-file-get-contents] <= 2.7.1 (unfixed)
unknown
- Affected:
- up to 2.7.1
- Fix:
- No patched version reported
CVE-2025-58653 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database