CVE-2025-10166 Overview
CVE-2025-10166 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Media Shortcodes plugin for WordPress. The flaw affects all versions up to and including 1.3.1. The plugin's twitter shortcode fails to sanitize user-supplied attributes and does not escape output properly. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browsers of any user who visits the affected page, including administrators. The issue is tracked under [CWE-79] and was documented in the Wordfence Vulnerability Report.
Critical Impact
Contributor-level users can inject persistent JavaScript that executes against administrators, enabling session hijacking, account takeover, and site defacement.
Affected Products
- Social Media Shortcodes plugin for WordPress, versions up to and including 1.3.1
- WordPress sites permitting contributor-level user registrations
- Any WordPress installation using the plugin's twitter shortcode
Discovery Timeline
- 2025-09-17 - CVE-2025-10166 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10166
Vulnerability Analysis
The Social Media Shortcodes plugin registers a twitter shortcode that accepts attributes from post content. The plugin passes these attributes directly into rendered HTML output without applying WordPress sanitization functions such as esc_attr() or sanitize_text_field(). As a result, the shortcode reflects attacker-controlled strings into the page markup.
Because the payload is persisted in post content, the attack qualifies as Stored XSS. Any subsequent page render triggers script execution in the visitor's browser session. The vulnerable code path is visible in the plugin source, and the fix landed in WordPress Changeset #3359485.
Root Cause
The root cause is missing input sanitization and output escaping on shortcode attributes. WordPress shortcode handlers must validate and escape all user-controlled data before emitting HTML. The plugin's twitter shortcode omitted both steps, treating attribute values as trusted markup.
Attack Vector
An authenticated attacker with contributor privileges creates or edits a post containing the twitter shortcode with a malicious attribute value. The payload persists in the WordPress database. When an editor, administrator, or site visitor loads the page, the browser parses and executes the injected script under the site's origin. This allows the attacker to steal cookies, perform actions as the victim, or pivot to full administrative compromise if an admin views the content.
No verified public exploit code is available. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-10166
Indicators of Compromise
- Post or page content containing [twitter] shortcodes with unusual attribute values including HTML tags, javascript: URIs, or event handlers such as onerror and onload
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages using the plugin
- New or modified administrator accounts following contributor activity on the site
Detection Strategies
- Audit the wp_posts table for shortcode attributes containing <script>, onerror=, onload=, or encoded script payloads
- Review WordPress audit logs for contributor-level accounts creating or editing posts that include the twitter shortcode
- Deploy a Content Security Policy (CSP) in report-only mode to surface script-source violations originating from post content
Monitoring Recommendations
- Alert on inline script execution from WordPress-rendered pages that violates the site's CSP
- Track privilege changes and administrator session anomalies correlated with recent contributor post edits
- Monitor plugin version inventory across WordPress fleets and flag installations at version 1.3.1 or lower
How to Mitigate CVE-2025-10166
Immediate Actions Required
- Update the Social Media Shortcodes plugin to a version above 1.3.1 that includes the fix from Changeset #3359485
- Review all posts and pages containing the [twitter] shortcode for malicious attribute values and remove any injected scripts
- Restrict contributor-level registrations and audit existing contributor accounts for unauthorized users
Patch Information
The vendor addressed the vulnerability in WordPress Changeset #3359485 by adding sanitization and output escaping to the twitter shortcode attributes. Site administrators should install the patched version through the WordPress plugin management interface. The plugin listing is available on the WordPress Plugin Directory.
Workarounds
- Deactivate the Social Media Shortcodes plugin until the patched version is deployed
- Remove or disable contributor-level accounts that do not require post creation privileges
- Implement a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
- Apply a Web Application Firewall (WAF) rule to block requests containing script payloads within shortcode attributes
# Example: Disable the plugin via WP-CLI until patched
wp plugin deactivate social-media-shortcodes
# Search the database for suspicious twitter shortcode payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP '\\[twitter[^\\]]*(<script|onerror=|onload=|javascript:)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
