CVE-2025-23569: Shortcode in Comment CSRF Vulnerability

CVE-2025-23569 Overview

CVE-2025-23569 is a Cross-Site Request Forgery (CSRF) vulnerability in the Kelvin Ng Shortcode in Comment WordPress plugin. The flaw affects all versions up to and including 1.1.1. An attacker can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) sink to inject persistent JavaScript into the affected site. Successful exploitation requires user interaction, typically tricking an authenticated user into visiting a malicious page. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can forge requests on behalf of authenticated users to inject stored JavaScript payloads, leading to session theft, administrative action abuse, and downstream site compromise.

Affected Products

Kelvin Ng Shortcode in Comment WordPress plugin
All versions from n/a through 1.1.1
WordPress sites running the vulnerable plugin with comments enabled

Discovery Timeline

2025-01-16 - CVE-2025-23569 published to the National Vulnerability Database
2026-04-23 - CVE-2025-23569 record last modified in NVD

Technical Details for CVE-2025-23569

Vulnerability Analysis

The Shortcode in Comment plugin extends WordPress comment functionality by allowing shortcodes to render inside user-submitted comments. The plugin fails to validate the origin and authenticity of state-changing requests, leaving administrative or content-modifying endpoints exposed to CSRF. When combined with insufficient output sanitization on shortcode-rendered content, an attacker can persist malicious markup in the database. The stored payload then executes in the browser context of any visitor who loads the affected page.

Root Cause

The root cause is the absence of anti-CSRF protections, specifically the omission of WordPress nonce verification through wp_verify_nonce() or check_admin_referer() on sensitive request handlers. The plugin also fails to sanitize and escape shortcode-derived content before persisting or rendering it. This combination converts a single CSRF primitive into a Stored XSS condition.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a malicious page containing a forged form or JavaScript that submits a crafted request to the target WordPress site. When an authenticated user visits the attacker-controlled page, the browser automatically attaches session cookies to the cross-origin request. The plugin processes the request without validating its origin, storing attacker-controlled markup that later executes as JavaScript for every visitor who renders the affected comment. Technical analysis is available in the Patchstack CVE Analysis.

Detection Methods for CVE-2025-23569

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes stored within WordPress comment records in the wp_comments table.
Outbound browser requests from site visitors to unfamiliar third-party domains originating from comment-bearing pages.
HTTP POST requests to plugin endpoints lacking a valid _wpnonce parameter or with anomalous Referer headers.

Detection Strategies

Audit the wp_comments and wp_commentmeta tables for shortcode payloads containing HTML tags or JavaScript URI schemes.
Inspect WordPress access logs for cross-origin POST requests to comment submission endpoints with missing or mismatched referers.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution in comment areas.

Monitoring Recommendations

Forward WordPress and reverse-proxy logs to a centralized SIEM for correlation of CSRF and XSS indicators.
Alert on administrator sessions that load attacker-controlled external URLs while authenticated.
Track plugin file integrity and database row changes within the comments tables to detect tampering.

How to Mitigate CVE-2025-23569

Immediate Actions Required

Disable or uninstall the Shortcode in Comment plugin until a patched release is verified.
Review and purge stored comments containing shortcode-injected HTML, scripts, or suspicious URLs.
Force a password reset and session invalidation for WordPress administrator accounts that may have interacted with attacker-controlled pages.

Patch Information

No fixed version is identified in the published advisory. Versions n/a through 1.1.1 are affected. Monitor the Patchstack advisory for an updated release and apply it immediately when available.

Workarounds

Restrict access to /wp-admin/ and plugin endpoints via IP allowlisting at the web server or WAF layer.
Deploy a Web Application Firewall rule to block requests to plugin endpoints lacking a valid _wpnonce parameter or Referer matching the site origin.
Enforce a strict Content Security Policy that disallows inline scripts in comment-rendering templates.
Disable shortcode parsing in comments by removing the do_shortcode filter from the comment_text hook.

bash

# Temporary mitigation: disable shortcode parsing in comments (add to theme functions.php)
remove_filter( 'comment_text', 'do_shortcode', 11 );