CVE-2025-4586
📋 TL;DR
The IRM Newsroom WordPress plugin has a stored cross-site scripting vulnerability in its 'irmcalendarview' shortcode. Authenticated attackers with contributor-level access or higher can inject malicious scripts that execute when users view compromised pages. This affects all WordPress sites using IRM Newsroom plugin versions up to 1.2.17.
💻 Affected Systems
- IRM Newsroom WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, redirect users to malicious sites, deface websites, or perform actions on behalf of authenticated users.
Likely Case
Attackers with contributor access inject malicious scripts to steal user session cookies or display phishing content to visitors.
If Mitigated
With proper input validation and output escaping, malicious scripts would be neutralized before execution.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once attacker has contributor credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.18 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/irm-newsroom/trunk/irm-newsroom.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find IRM Newsroom plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install fresh version from WordPress repository.
🔧 Temporary Workarounds
Remove Contributor Access
allTemporarily remove contributor-level access from untrusted users until patch is applied.
Disable Shortcode
allRemove or disable the 'irmcalendarview' shortcode from posts/pages.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads in shortcode attributes
- Apply Content Security Policy (CSP) headers to restrict script execution sources
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins → IRM Newsroom version numberCheck Version:
wp plugin list --name=irm-newsroom --field=versionVerify Fix Applied:
Verify plugin version is 1.2.18 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual shortcode modifications in post/page edits
- Multiple failed login attempts followed by contributor account access
Network Indicators:
- Suspicious JavaScript payloads in HTTP POST requests to wp-admin/post.php
SIEM Query:
source="wordpress.log" AND "irmcalendarview" AND ("script" OR "onerror" OR "javascript:")