CVE-2025-13856 Overview
The Extra Post Images plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the extra-images shortcode. The flaw affects all versions up to and including 1.0. Attackers with Contributor-level access or higher can inject arbitrary JavaScript through the shortcode's id parameter. The injected scripts execute in the browser of any user who views the affected page. The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handler, tracked as [CWE-79].
Critical Impact
Authenticated contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced actions, and account takeover.
Affected Products
- Extra Post Images plugin for WordPress, versions up to and including 1.0
- WordPress sites permitting Contributor-level or higher registration
- WordPress installations rendering the extra-images shortcode
Discovery Timeline
- 2025-12-06 - CVE-2025-13856 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13856
Vulnerability Analysis
The vulnerability resides in the plugin's shortcode processor for extra-images, defined in epi.php. The shortcode accepts an id attribute supplied by post authors. The plugin reflects this attribute into HTML output without applying proper escaping functions such as esc_attr() or esc_html(). Because WordPress stores shortcodes as part of post content, the payload persists in the database and executes each time the page is rendered.
Contributor-level accounts can save posts but cannot publish them directly. However, once an editor or administrator previews or approves the submission, the injected script executes in a higher-privileged browser context. This creates a privilege escalation path from Contributor to Administrator through session hijacking or forced administrative actions via cross-origin requests.
Root Cause
The plugin fails to sanitize user-controlled attribute values before echoing them into the DOM. WordPress provides sanitization primitives that the shortcode handler does not invoke. The affected code paths are documented in the plugin source at line 92 and line 101.
Attack Vector
An authenticated attacker with Contributor-level access authors a post containing the extra-images shortcode with a malicious id value. The payload breaks out of the intended attribute context and injects a <script> tag or event handler. When any authenticated user or visitor views the rendered page, the browser executes the attacker-controlled JavaScript within the site's origin. See the Wordfence Vulnerability Report for additional context.
No verified exploit code is publicly available at this time.
Detection Methods for CVE-2025-13856
Indicators of Compromise
- Post or page content containing [extra-images id="..."] shortcodes with unusual characters such as ", <, >, or on*= event handlers inside the id attribute
- Unexpected outbound requests from admin browser sessions to attacker-controlled hosts shortly after previewing contributor submissions
- New administrator accounts or role changes correlated with contributor post activity
Detection Strategies
- Query the wp_posts table for post_content LIKE '%[extra-images%' and inspect matching entries for script fragments in the id attribute
- Enable WordPress audit logging to capture post creation and role changes by Contributor accounts
- Deploy a web application firewall rule that inspects POST bodies to wp-admin/post.php for shortcode attributes containing HTML control characters
Monitoring Recommendations
- Alert on anomalous JavaScript execution and DOM modifications originating from post preview or public rendering flows
- Correlate contributor login events with administrator session activity that occurs shortly afterward
- Monitor for the installation and activation of the Extra Post Images plugin across managed WordPress fleets
How to Mitigate CVE-2025-13856
Immediate Actions Required
- Deactivate and remove the Extra Post Images plugin from all WordPress installations until a patched release is available
- Audit existing posts and pages for the extra-images shortcode and remove any suspicious id values
- Restrict new user registration and review existing Contributor-level accounts for legitimacy
Patch Information
At the time of publication, the plugin has no vendor-supplied patch. Version 1.0 is the latest release and remains vulnerable. Site operators should monitor the WordPress plugin repository for an updated release and apply it once available.
Workarounds
- Uninstall the plugin and replace its functionality with a maintained alternative
- Limit user registration to trusted roles and disable Contributor-level self-registration
- Deploy a web application firewall with rules that block HTML metacharacters in WordPress shortcode attributes
- Configure a strict Content Security Policy (CSP) that disallows inline scripts on WordPress front-end pages
# Example: disable open registration and remove the plugin via WP-CLI
wp option update users_can_register 0
wp plugin deactivate extra-post-images
wp plugin uninstall extra-post-images
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
