CVE-2025-1509 is a high severity code injection flaw in the Show Me The Cookies WordPress plugin, all versions up to and including 1.0. An action runs do_shortcode on a value that is not validated, so unauthenticated visitors can run arbitrary shortcodes. NVD scores it 7.3. The record names no fixed version, so remove or replace the plugin.
What's affected
The record lists Show Me The Cookies by wpguru, all versions up to and including 1.0. The record says all versions up to and including 1.0 are affected and names no fixed version. The WordPress.org page we fetched describes a plugin that lists cookies and offers a shortcode, and shows no patched release in the text we read. Check the plugin page and changelog yourself before relying on any update. The record is sourced from Wordfence, whose entry is linked from the CVE.
How to check if you're exposed
Check whether the plugin is installed on any site, using WP-CLI from each site's root.
wp plugin list --fields=name,status,version | grep show-me-the-cookies
If you manage many sites, run the same check across them, or look under Plugins in each dashboard. A deactivated plugin still sits on disk and its code may still be reachable, so look at inactive entries too.
wp plugin deactivate show-me-the-cookies
wp plugin delete show-me-the-cookies
The vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) shows the attack needs no account at all and no user interaction, so any site with the plugin present is exposed to anyone who can reach it.
What to do now
- Find every WordPress site that has
show-me-the-cookiesinstalled, active or not. - Deactivate and delete the plugin. No fixed version is named in the record.
- If you rely on the function, replace it with a maintained plugin or a few lines of theme code you control.
- Review recent content and options for unexpected shortcode output, and check admin users for accounts you do not recognise.
- Add a plugin policy: remove anything unmaintained, closed or no longer used, and review the list each quarter.
Why it matters
The weakness is CWE-94, code injection. In this case the unsafe step is calling do_shortcode on a value the visitor controls. Shortcodes are small pieces of code that WordPress expands into content, and some plugins register shortcodes that read data or perform actions. Letting outsiders choose which one runs gives them a menu of behaviours the site owner never meant to offer.
How bad it gets depends on which shortcodes the site has installed, so impact varies from nothing to serious. The record scores it 7.3. It is not on the CISA KEV list. The general lesson is to treat any code path that expands user input as executable.
Going further
WordPress sites collect plugins over time, and the ones that cause trouble are often small utilities installed once and forgotten. A short monthly review that removes anything unused cuts exposure more than most scanners do.
If you operate a fleet of sites, keep a central list of plugin slugs and versions. Then a CVE like this one is a search, not a hunt.
Quick check
Is a patched version available?
The record names none. Remove the plugin or replace it, and check the plugin page for any later release notes.
Does deactivating the plugin protect me?
Deactivating stops WordPress from loading it. Deleting is cleaner because files left on disk are an extra thing to track.
Sources
- Safeguard Gold record for CVE-2025-1509
- NVD entry for CVE-2025-1509
- Fetched reference on wordpress.org
Last reviewed: 19 October 2026.
