CVE-2025-10136: TweetThis Shortcode XSS Vulnerability

CVE-2025-10136 Overview

CVE-2025-10136 is a Stored Cross-Site Scripting (XSS) vulnerability in the TweetThis Shortcode plugin for WordPress. The flaw affects all plugin versions up to and including 1.8.0. It resides in the plugin's tweetthis shortcode, which fails to properly sanitize input and escape output for user-supplied attributes. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page, enabling session theft, redirection, or actions performed on behalf of higher-privileged users.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes for site visitors and administrators, enabling account takeover paths and content defacement.

Affected Products

TweetThis Shortcode plugin for WordPress — all versions through 1.8.0
WordPress sites permitting Contributor-level user registration with the plugin installed
Multi-author WordPress deployments using the tweetthis shortcode

Discovery Timeline

2025-09-26 - CVE-2025-10136 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10136

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The tweetthis shortcode processes attributes supplied by the post author and renders them into page markup without adequate sanitization or output escaping. When a Contributor submits a post containing a crafted shortcode, the malicious attribute values persist in the WordPress database. Any user who later views the post triggers script execution in their browser session.

Because the payload is stored, exploitation does not require social engineering of individual victims. Editors and administrators who review submitted content in the frontend context become high-value targets. Successful exploitation can lead to cookie theft, forced administrative actions via authenticated requests, and content injection that redirects visitors to attacker-controlled infrastructure.

The scope change reflected in the vulnerability metrics indicates that the injected script executes in the browser trust context of any site visitor, not just the attacker's own session.

Root Cause

The plugin source file dkts.php in the tweetthis-shortcode package processes shortcode attributes without invoking WordPress escaping functions such as esc_attr() or esc_html() before writing values into rendered HTML. Input passed through the shortcode handler is not filtered against a strict allowlist, allowing HTML and JavaScript payload characters to survive rendering.

Attack Vector

An authenticated attacker with Contributor privileges authors a post or page containing the tweetthis shortcode with a malicious attribute payload. Upon submission, the payload is stored in the WordPress wp_posts table. When a subsequent visitor — including reviewers, editors, or administrators moderating the submission — loads the affected page, the browser parses and executes the injected script under the site's origin.

The vulnerability requires no user interaction from the victim beyond loading the page. Refer to the Wordfence Vulnerability Report and the WordPress Plugin DKTS File for technical context on the affected shortcode handler.

Detection Methods for CVE-2025-10136

Indicators of Compromise

Post or page content in wp_posts containing [tweetthis] shortcode instances with attribute values including <script>, onerror=, onload=, or JavaScript URI schemes
Unexpected outbound requests from visitor browsers to unfamiliar domains after loading pages authored by Contributor accounts
New or modified administrator accounts created shortly after a Contributor submitted content containing the shortcode
Web server access logs showing repeated retrieval of a specific post URL from privileged administrative sessions

Detection Strategies

Query the WordPress database for tweetthis shortcode usage and inspect attribute values for HTML tags or event handler attributes
Deploy web application firewall rules that block shortcode attribute payloads containing script tags or JavaScript event handlers
Enable Content Security Policy (CSP) headers in report-only mode to surface unexpected inline script execution on affected pages
Review Contributor-role user activity logs for post creations or revisions immediately preceding visitor-side anomalies

Monitoring Recommendations

Alert on any new user registrations that request Contributor role or higher when self-registration is enabled
Monitor WordPress audit logs for post revisions that add or modify tweetthis shortcode invocations
Track browser-side error telemetry for CSP violations originating from pages containing the vulnerable shortcode
Correlate administrator authentication events with recent views of Contributor-submitted content

How to Mitigate CVE-2025-10136

Immediate Actions Required

Deactivate the TweetThis Shortcode plugin on all WordPress instances until a patched version is confirmed available
Audit existing posts and pages for tweetthis shortcode instances and remove any containing suspicious attribute values
Restrict Contributor-level registrations and review recently created accounts for legitimacy
Force password resets for administrator accounts that may have viewed exploited content

Patch Information

All versions of the TweetThis Shortcode plugin up to and including 1.8.0 are affected. Administrators should monitor the plugin's WordPress.org listing for a security release above version 1.8.0. If no patched version has been published, remove the plugin entirely rather than leaving it active. Consult the Wordfence Vulnerability Report for updated remediation status.

Workarounds

Remove the plugin from the wp-content/plugins/tweetthis-shortcode/ directory if a patch is unavailable
Restrict the unfiltered_html capability and revoke shortcode usage from Contributor and Author roles via role management plugins
Deploy a web application firewall rule blocking POST requests to wp-admin/post.php containing tweetthis shortcode payloads with HTML tags in attributes
Implement a strict Content Security Policy that disallows inline script execution site-wide

bash

# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate tweetthis-shortcode
wp plugin delete tweetthis-shortcode

# Audit database for shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%[tweetthis%'"