CVE-2025-1559: CC-IMG-Shortcode WordPress Plugin XSS Flaw

CVE-2025-1559 Overview

CVE-2025-1559 is a stored Cross-Site Scripting (XSS) vulnerability in the CC-IMG-Shortcode plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.0. It exists in the plugin's img shortcode handler, where user-supplied attributes are not properly sanitized or escaped before being rendered.

Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into posts or pages. The malicious script executes in the browser of any visitor who views the affected content, enabling session theft, redirection, and unauthorized actions in the context of the victim.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript on WordPress pages, executing in visitors' browsers including administrators.

Affected Products

WordPress CC-IMG-Shortcode plugin versions ≤ 1.1.0
WordPress installations with the CC-IMG-Shortcode plugin active
Any site allowing contributor-or-higher registration with this plugin installed

Discovery Timeline

2025-03-13 - CVE-2025-1559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1559

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]: Improper Neutralization of Input During Web Page Generation. It resides in the img shortcode processor implemented in class-img-shortcode.php. The shortcode accepts attributes from post content and outputs them into HTML without adequate sanitization or escaping.

Because WordPress contributors can author posts containing shortcodes, an attacker with contributor privileges can embed a crafted [img] shortcode. When the post is previewed or published, the shortcode renders unsanitized attribute values directly into the DOM. Any user visiting the page executes the injected script under the site's origin.

The scope change reflected in the vulnerability's characteristics indicates the injected script executes in a security context distinct from the vulnerable component. This is typical for stored XSS in WordPress, where the plugin renders content that browsers execute under the parent site's origin.

Root Cause

The plugin fails to apply WordPress sanitization primitives such as esc_attr(), esc_url(), or wp_kses() to shortcode attributes before echoing them into the HTML output. User-controlled values pass through the shortcode handler and reach the response body unmodified, allowing HTML and JavaScript payloads embedded in attribute strings to break out of intended contexts.

Attack Vector

An attacker with an authenticated contributor account crafts a post containing the plugin's img shortcode with malicious attribute values. The injected payload can include event handlers or script tags that trigger when a viewer renders the page. Because contributor accounts can be self-registered on many WordPress sites, exploitation prerequisites are low. The stored nature of the payload means every subsequent view of the page triggers the script, including when an administrator previews or moderates the content.

No verified exploit code is publicly available. See the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the vulnerable handler.

Detection Methods for CVE-2025-1559

Indicators of Compromise

Post or page content containing [img] shortcodes with attributes holding <script>, javascript:, or on*= event handlers
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that use the plugin
New or modified posts authored by contributor-level accounts referencing external JavaScript resources
Presence of the CC-IMG-Shortcode plugin at version ≤ 1.1.0 in wp-content/plugins/cc-img-shortcode/

Detection Strategies

Query the WordPress wp_posts table for post_content matching the plugin's shortcode with suspicious attribute values containing HTML entities or script keywords
Review contributor and author account activity for posts created shortly after account registration
Use a WordPress security scanner to enumerate installed plugins and flag CC-IMG-Shortcode versions ≤ 1.1.0

Monitoring Recommendations

Enable web application firewall (WAF) rules that inspect POST bodies to /wp-admin/post.php for XSS payloads inside shortcode attributes
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages using the plugin
Log and alert on privilege changes or role escalations following contributor account activity

How to Mitigate CVE-2025-1559

Immediate Actions Required

Deactivate and remove the CC-IMG-Shortcode plugin until a patched version is confirmed available
Audit existing posts and pages for [img] shortcodes containing suspicious attribute payloads and sanitize or delete affected content
Restrict contributor account creation and review recent contributor registrations for indicators of abuse
Rotate administrator session cookies and reset credentials if malicious shortcode content is found

Patch Information

At time of publication, no fixed version is confirmed in the NVD entry. All versions up to and including 1.1.0 are vulnerable. Monitor the WordPress CC Img Shortcode Plugin page for updates and apply the vendor patch immediately upon release. Consult the Wordfence Vulnerability Analysis for remediation guidance.

Workarounds

Remove the plugin entirely and replace image embedding with the built-in WordPress image block
Restrict post publication and preview privileges to trusted editor-and-above roles using a role management plugin
Deploy a WAF rule blocking [img] shortcodes containing <, >, javascript:, or on attribute patterns in submitted content
Enforce a strict Content Security Policy that disallows inline scripts on public-facing pages

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate cc-img-shortcode
wp plugin delete cc-img-shortcode

# Search post content for suspicious shortcode payloads
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content REGEXP '\\[img[^\\]]*(<script|javascript:|on[a-z]+=)'"