WordPress: Stored XSS via Currency Shortcode in Euro FxRef Currency Converter Plugin

In Euro FxRef Currency Converter plugin for WordPress versions up to and including 2.0.2 a medium severity vulnerability CVE-2025-6257 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the plugin’s currency shortcode due to insufficient input sanitization and output escaping. These scripts execute whenever a user accesses an injected page. To address this issue, users should upgrade Euro FxRef Currency Converter plugin to versions 2.0.3 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-6257.