CVE-2025-6460
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>Display content conditionally based on a schedule. Choose from three scheduling modes:</p>
<ol>
<li><strong>Date Range</strong> – Show content between specific start and end dates</li>
<li><strong>Recurring</strong> – Show content on specific days of the week during a time window</li>
<li><strong>Custom</strong> – Use PHP strtotime expressions for flexible scheduling</li>
</ol>
<h4>Gutenberg Block</h4>
<p>The <strong>Display During</strong> block provides a visual editor with:</p>
<ul>
<li>Sidebar controls for all three scheduling modes</li>
<li>Date/time pickers for start and end dates</li>
<li>Day-of-week checkboxes for recurring schedules</li>
<li>Live status indicator (active/inactive)</li>
<li>Optional fallback message when content is hidden</li>
<li>Copy as Shortcode toolbar button</li>
</ul>
<h4>Shortcodes</h4>
<p>The <code>[display_during]</code> shortcode works in the Classic Editor and anywhere shortcodes are supported.</p>
<p><strong>Date range:</strong><br />
[display_during start_day_time=”June 1, 2026 8:00 am” end_day_time=”December 31, 2026 11:59 pm”]Content here[/display_during]</p>
<p><strong>Recurring schedule (new in 2.0):</strong><br />
[display_during days=”mon,wed,fri” start_time=”09:00″ end_time=”17:00″]Office hours content[/display_during]</p>
<p><strong>Custom strtotime:</strong><br />
[display_during start_day_time=”Sun 8:00 am” end_day_time=”Mon 8:00 pm”]Weekend content[/display_during]</p>
<p><strong>With fallback message:</strong><br />
[display_during end_day_time=”June 1, 2026″]Register now![display_during_message]Registration has closed.[/display_during_message][/display_during]</p>
<h4>Shortcode Parameters</h4>
<ul>
<li><code>start_day_time</code> – When to start showing content (strtotime string or date)</li>
<li><code>end_day_time</code> – When to stop showing content</li>
<li><code>days</code> – Comma-separated days for recurring mode (mon,tue,wed,thu,fri,sat,sun)</li>
<li><code>start_time</code> – Start time for recurring mode (HH:MM format)</li>
<li><code>end_time</code> – End time for recurring mode (HH:MM format)</li>
<li><code>timezone_location</code> – PHP timezone identifier (defaults to site timezone)</li>
<li><code>message</code> – Plain text fallback message (legacy; use nested shortcode for rich content)</li>
</ul>
WordPress Plugin Directory