CVE-2025-0370
📋 TL;DR
The WP Shortcodes Plugin — Shortcodes Ultimate for WordPress is vulnerable to stored cross-site scripting (XSS) via the 'src' parameter. This allows authenticated attackers with Contributor-level access or higher to inject malicious scripts that execute when users view affected pages. All WordPress sites using this plugin up to version 7.3.3 are affected.
💻 Affected Systems
- WP Shortcodes Plugin — Shortcodes Ultimate
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or install backdoors for persistent access.
Likely Case
Attackers inject malicious scripts to steal user session cookies, perform phishing attacks, or display unwanted advertisements.
If Mitigated
With proper user role management and content review processes, impact is limited to potential defacement of non-critical pages.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple. The vulnerability details and patch are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.4
Vendor Advisory: https://wordpress.org/plugins/shortcodes-ultimate/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Shortcodes Ultimate' and click 'Update Now'. 4. Verify version is 7.3.4 or higher.
🔧 Temporary Workarounds
Disable vulnerable shortcodes
allDisable lightbox and other potentially affected shortcodes via plugin settings
Restrict user roles
allTemporarily remove Contributor-level posting permissions
🧯 If You Can't Patch
- Remove the Shortcodes Ultimate plugin entirely
- Implement web application firewall (WAF) rules to block XSS payloads in 'src' parameters
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → Shortcodes Ultimate versionCheck Version:
wp plugin list --name='shortcodes-ultimate' --field=versionVerify Fix Applied:
Confirm plugin version is 7.3.4 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wp-admin with 'src' parameters containing script tags
- Multiple failed login attempts followed by successful Contributor-level login
Network Indicators:
- Outbound connections to suspicious domains from WordPress pages
- Unexpected JavaScript loading from WordPress content
SIEM Query:
source="wordpress.log" AND ("src=" AND ("<script" OR "javascript:" OR "onerror="))🔗 References
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/includes/shortcodes/lightbox.php#L75
- https://plugins.trac.wordpress.org/changeset/3229060/
- https://wordpress.org/plugins/shortcodes-ultimate/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f0869c35-9ea8-46a5-8bba-23d7ef47355a?source=cve
