CVE-2025-12823 Overview
CVE-2025-12823 is a Stored Cross-Site Scripting (XSS) vulnerability in the CSV to SortTable plugin for WordPress. The flaw affects all plugin versions up to and including 4.2. The plugin fails to properly sanitize input and escape output on user-supplied attributes passed to the csv shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses an affected page, enabling session theft, redirection, and content manipulation. The vulnerability is tracked under CWE-79 and was published to the National Vulnerability Database on November 18, 2025.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against every visitor of affected WordPress pages, including administrators.
Affected Products
- CSV to SortTable plugin for WordPress, all versions up to and including 4.2
- WordPress sites permitting Contributor-level user registration or delegated content authorship
- Any page containing the vulnerable csv shortcode with attacker-controlled attributes
Discovery Timeline
- 2025-11-18 - CVE-2025-12823 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12823
Vulnerability Analysis
The CSV to SortTable plugin registers a csv shortcode that renders CSV data as sortable HTML tables inside WordPress posts and pages. The shortcode accepts user-supplied attributes to control rendering behavior. The plugin passes these attribute values into the generated HTML without applying sufficient sanitization or output escaping. An attacker with Contributor-level access can craft shortcode attributes containing HTML event handlers or <script> payloads. When WordPress renders the post, the payload becomes part of the page markup and executes in every visitor's browser session. Because Contributor accounts can author content but not publish it, exploitation typically triggers when an editor or administrator previews or publishes the malicious draft. The stored nature of the injection means the payload persists across sessions and affects all subsequent visitors.
Root Cause
The root cause is missing input sanitization and missing output escaping on shortcode attributes. The plugin does not apply WordPress helpers such as esc_attr(), esc_html(), or wp_kses() before writing attribute values into the rendered HTML. This maps directly to CWE-79: Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires an authenticated account with Contributor privileges or higher. The attacker creates or edits a post containing the csv shortcode with a malicious attribute value carrying JavaScript. Once the post is rendered, the script executes in the context of the WordPress site's origin. Attackers can hijack administrator sessions, exfiltrate nonces, create rogue admin accounts, or pivot to further plugin abuse. The scope-changed CVSS metric reflects that the executed script operates outside the vulnerable component's original security boundary. Refer to the Wordfence vulnerability report for additional technical detail.
Detection Methods for CVE-2025-12823
Indicators of Compromise
- WordPress posts or pages containing the [csv] shortcode with attributes holding <script>, onerror=, onload=, or javascript: fragments
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading a page with the csv shortcode
- Newly created administrator accounts or modified user roles shortly after Contributor activity on posts with the shortcode
Detection Strategies
- Query the wp_posts table for post_content containing [csv combined with common XSS tokens such as on, script, or javascript:
- Review the audit trail for Contributor accounts authoring or editing posts that use the csv shortcode
- Compare rendered page HTML against expected shortcode output to identify injected script or event handler attributes
Monitoring Recommendations
- Enable a WordPress activity log plugin to track post creation, revision, and role changes tied to Contributor accounts
- Deploy a Web Application Firewall (WAF) rule that inspects shortcode attribute payloads for script tags and event handlers
- Alert on administrator session activity that correlates with rendering pages containing the csv shortcode
How to Mitigate CVE-2025-12823
Immediate Actions Required
- Deactivate the CSV to SortTable plugin on any WordPress site running version 4.2 or earlier until a patched release is installed
- Audit all posts and pages containing the [csv] shortcode and remove attributes containing HTML or JavaScript payloads
- Restrict Contributor and higher role assignments to trusted users and review recent role grants for anomalies
Patch Information
At the time of publication, the WordPress plugin directory listing for CSV to SortTable should be consulted for the latest release. Administrators should upgrade to a version later than 4.2 once the vendor publishes a fix that adds proper sanitization and escaping on shortcode attributes.
Workarounds
- Remove the csv shortcode from posts authored by non-administrator users until the plugin is updated
- Apply a Content Security Policy (CSP) that blocks inline script execution to reduce the impact of injected payloads
- Downgrade Contributor accounts to Subscriber where content authorship is not strictly required
# Example: locate posts containing the vulnerable shortcode via WP-CLI
wp post list --post_status=any --format=ids \
| xargs -n1 -I{} sh -c 'wp post get {} --field=post_content | grep -l "\[csv" && echo "post_id={}"'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
