Medium 6.4 Unfixed 2025-12-05≤ 2.5 Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVEWordfence