CVE-2025-10180: WordPress Markdown Shortcode XSS Vulnerability

CVE-2025-10180 Overview

CVE-2025-10180 is a stored cross-site scripting (XSS) vulnerability in the Markdown Shortcode plugin for WordPress. The flaw affects all versions up to and including 0.2.1. It stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's markdown shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. These scripts execute in the browser of any user who visits an affected page. The issue is tracked as CWE-79 and was resolved in version 0.2.3.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that runs in the context of site visitors, including administrators, enabling session theft, forced actions, and site compromise.

Affected Products

Markdown Shortcode plugin for WordPress, versions up to and including 0.2.1
WordPress sites permitting contributor-level or higher registrations
Any site using the vulnerable markdown shortcode in published content

Discovery Timeline

2025-09-26 - CVE-2025-10180 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10180

Vulnerability Analysis

The Markdown Shortcode plugin exposes a [markdown] shortcode that renders Markdown content into HTML using the Parsedown library. The plugin fails to sanitize and escape attributes passed to this shortcode before including them in rendered output. Attackers submit shortcode attributes containing HTML or JavaScript payloads that persist in the WordPress database. When a viewer loads the affected page, the browser executes the payload in the site's origin.

Because the shortcode is available to contributors, an attacker only needs a low-privileged account to write malicious content. Exploitation does not require user interaction beyond visiting the affected page. Successful execution can hijack administrator sessions, force privileged actions through the REST API, or pivot to full site takeover.

Root Cause

The root cause is missing input sanitization and output escaping on shortcode attributes in the plugin's rendering function at markdown-shortcode.php. User-controlled attribute values flow directly into HTML output without calls to WordPress escaping functions such as esc_attr() or wp_kses(). The Parsedown parser is invoked without safe mode restrictions on attribute contexts.

Attack Vector

An authenticated contributor submits a post containing a crafted [markdown] shortcode with attributes carrying script payloads. After publication or preview, any authenticated or unauthenticated visitor triggers execution. The attack requires low privileges and no user interaction beyond page navigation.

php

// Patched version metadata from markdown-shortcode.php
// Source: https://github.com/JohannesHoppe/markdown-shortcode/commit/2f02cd680eb60cc7d4a92cc64506095d304a95ff
/*
Plugin Name: Markdown Shortcode
Description: damn simple [markdown]#via shortcode[/markdown], uses parsedown (parsedown.org) and highlight.js (highlightjs.org)
-Version:     0.2.2
+Version:     0.2.3
Author:      Johannes Hoppe
Author URI:  http://haushoppe-its.de
*/

The accompanying Readme.txt change explicitly notes the security fix: Security Fix: Prevent XSS vulnerability (CVE-2025-10180). See the GitHub commit and the WordPress plugin source.

Detection Methods for CVE-2025-10180

Indicators of Compromise

Post or page content containing [markdown] shortcodes with attributes holding <script>, onerror=, onload=, or javascript: values
Unexpected outbound requests from browser sessions to attacker-controlled domains referrer-linked to WordPress pages
Administrator sessions exhibiting REST API calls to /wp-json/wp/v2/users or plugin endpoints that were not user-initiated
New administrator accounts or modified user roles shortly after a contributor published Markdown content

Detection Strategies

Query the wp_posts table for post_content values containing [markdown combined with event handler substrings or <script
Review plugin version reporting to identify installations still running Markdown Shortcode 0.2.1 or earlier
Enable a web application firewall rule that inspects post submissions from contributor accounts for shortcode attribute injection patterns

Monitoring Recommendations

Monitor Content-Security-Policy violation reports for inline script executions on pages containing the markdown shortcode
Alert on contributor role account creations followed by rapid post publication activity
Log and review all shortcode-rendered output during editorial review workflows before making posts public

How to Mitigate CVE-2025-10180

Immediate Actions Required

Update the Markdown Shortcode plugin to version 0.2.3 or later through the WordPress plugin dashboard
Audit existing posts and pages for [markdown] shortcode usage containing suspicious attributes and remove or sanitize them
Restrict contributor role assignments and review recently created accounts with content publication privileges
Rotate administrator session cookies and force re-authentication for privileged users

Patch Information

The vendor released version 0.2.3 addressing this vulnerability. The fix is documented in the GitHub release v0.2.3 and the WordPress changeset. Additional analysis is available in the Wordfence vulnerability report.

Workarounds

Deactivate the Markdown Shortcode plugin until version 0.2.3 can be deployed
Remove or restrict the contributor role and require editor-level review before publishing any post containing shortcodes
Deploy a Content Security Policy that disallows inline scripts and unsafe event handlers on public-facing pages

bash

# Update the plugin via WP-CLI
wp plugin update markdown-shortcode --version=0.2.3

# Verify installed version
wp plugin get markdown-shortcode --field=version

# Search posts for potentially malicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[markdown%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"