CVE-2025-22267: Weaver Themes Shortcode XSS Vulnerability

CVE-2025-22267 Overview

CVE-2025-22267 is a stored Cross-Site Scripting (XSS) vulnerability in the Weaver Themes Shortcode Compatibility WordPress plugin by wpweaver. The flaw affects all versions up to and including 1.0.4. It stems from improper neutralization of input during web page generation, classified under [CWE-79]. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the database and executes in the browser of any user who views the affected page.

Critical Impact
An authenticated contributor-level attacker can inject persistent JavaScript that executes in administrator browsers, enabling session hijacking, privilege escalation, and site takeover on WordPress installations running vulnerable plugin versions.

Affected Products

wpweaver Weaver Themes Shortcode Compatibility plugin (weaver-themes-shortcode-compatibility)
All versions from initial release through 1.0.4
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-01-21 - CVE-2025-22267 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22267

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Weaver Themes Shortcode Compatibility plugin. The plugin fails to properly sanitize user-supplied input before rendering it within generated web pages. Malicious payloads submitted through plugin inputs are stored in the WordPress database and returned unescaped when the affected pages load.

Stored XSS is more damaging than reflected variants because the payload persists and fires against every visitor who loads the affected page. Exploitation requires low privileges combined with user interaction, meaning an attacker with a contributor or author-level account can plant a payload that later executes in an administrator's browser session.

The scope-change indication reflects that a successful exploit affects resources beyond the vulnerable component. An attacker leveraging administrator context can create backdoor accounts, install malicious plugins, or exfiltrate site content.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders user-controlled data within HTML contexts. Under [CWE-79], input passed through the plugin's shortcode compatibility handlers is not filtered with functions such as esc_html(), esc_attr(), or wp_kses() before being echoed to the response.

Attack Vector

The attack vector is network-based over standard HTTP or HTTPS requests to the WordPress site. An attacker authenticated with low privileges submits crafted input containing JavaScript payloads through plugin fields that accept shortcode content. When a victim, typically a site administrator or editor, loads the page containing the stored payload, the script executes in the victim's browser under the site's origin.

See the Patchstack XSS Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-22267

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in WordPress wp_posts or wp_postmeta tables tied to plugin shortcodes.
Outbound browser requests from administrator sessions to unknown domains shortly after loading pages that render Weaver Themes shortcodes.
Creation of unexpected administrator accounts or modification of plugin and theme files following administrator visits to affected pages.

Detection Strategies

Audit database records generated by the weaver-themes-shortcode-compatibility plugin for HTML and JavaScript tokens using SQL pattern matching on stored shortcode content.
Deploy a Web Application Firewall (WAF) rule to flag POST requests to WordPress admin endpoints containing script tags, event handlers, or encoded XSS payloads.
Monitor for anomalous administrator actions occurring immediately after page views that reference the vulnerable plugin's shortcodes.

Monitoring Recommendations

Enable WordPress audit logging to capture content edits, user creations, and plugin or theme changes performed by low-privilege accounts.
Ingest web server access logs into a centralized SIEM and correlate POST requests to wp-admin with subsequent privileged actions.
Configure a strict Content Security Policy (CSP) with reporting enabled to detect inline script execution attempts on rendered pages.

How to Mitigate CVE-2025-22267

Immediate Actions Required

Deactivate and remove the Weaver Themes Shortcode Compatibility plugin until a patched release is confirmed installed.
Review all posts, pages, and shortcode-generated content produced while the plugin was active and remove any embedded scripts.
Audit WordPress user accounts, sessions, and application passwords for unauthorized additions or role changes.

Patch Information

No fixed version is identified in the available advisory data; the vulnerability affects all releases through 1.0.4. Consult the Patchstack advisory and the plugin repository for updated patch status before reinstalling.

Workarounds

Restrict contributor, author, and editor account provisioning to trusted users and enforce multi-factor authentication for all WordPress logins.
Apply a WAF rule set that blocks XSS payload patterns targeting WordPress admin and shortcode endpoints.
Enforce a Content Security Policy that disallows inline scripts and limits script sources to trusted origins.

bash

# Example: disable the vulnerable plugin using WP-CLI
wp plugin deactivate weaver-themes-shortcode-compatibility
wp plugin delete weaver-themes-shortcode-compatibility

# Example: search stored content for suspicious script markers
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%javascript:%';"