CVE-2025-23791: Horizontal Line Shortcode XSS Vulnerability

CVE-2025-23791 Overview

CVE-2025-23791 is a stored cross-site scripting (XSS) vulnerability in the Horizontal Line Shortcode WordPress plugin by mikakaltoft. The flaw affects all plugin versions up to and including 1.0. Authenticated attackers with low privileges can inject malicious scripts that persist in the database and execute in the browsers of users who view the affected pages. The issue is tracked under CWE-79, improper neutralization of input during web page generation.

Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account takeover through persistent script injection into WordPress content.

Affected Products

mikakaltoft Horizontal Line Shortcode plugin for WordPress
All versions from n/a through 1.0
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-16 - CVE-2025-23791 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23791

Vulnerability Analysis

The Horizontal Line Shortcode plugin fails to sanitize user-supplied input before rendering it within WordPress pages. The plugin registers a shortcode that accepts attributes and outputs HTML content without proper encoding. Attackers with contributor or higher privileges can embed the shortcode with malicious payloads that execute when other users, including administrators, load the affected content.

Stored XSS in WordPress plugins is particularly impactful because payloads persist across sessions and reach any visitor who renders the tainted post or page. The vulnerability requires user interaction to trigger, and the scope is marked as changed because injected scripts execute in the trusted context of the WordPress site.

Root Cause

The root cause is missing output encoding within the shortcode handler. The plugin renders shortcode attributes or content directly into HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows script tags and event handler attributes to reach the rendered DOM intact.

Attack Vector

An authenticated attacker with post editing privileges inserts the plugin's shortcode with a crafted payload containing JavaScript. When a victim views the post, the browser executes the injected script under the origin of the WordPress site. The attacker can steal session cookies, perform actions on behalf of administrators, or redirect users to malicious infrastructure.

No verified public exploit is available. Refer to the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-23791

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs embedded in post content stored in the wp_posts table
Outbound requests from browser sessions to unfamiliar domains after loading pages that use the plugin's shortcode
New or modified administrator accounts created shortly after a low-privilege user edited content containing the shortcode

Detection Strategies

Audit WordPress database entries in wp_posts for shortcode invocations of the Horizontal Line Shortcode plugin containing script content or HTML event attributes
Deploy a web application firewall rule to inspect POST requests to wp-admin/post.php and wp-admin/admin-ajax.php for XSS payloads in shortcode parameters
Monitor WordPress activity logs for content edits performed by contributor and author accounts, correlating with unusual admin session activity

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to surface script execution violations that indicate injected payloads
Log and alert on plugin activation and shortcode usage changes across authors and contributors
Track browser telemetry from administrator sessions for anomalous DOM modifications or credential form activity

How to Mitigate CVE-2025-23791

Immediate Actions Required

Deactivate and remove the Horizontal Line Shortcode plugin until a patched version is released
Review all posts and pages containing the plugin's shortcode and remove any content injected by untrusted users
Rotate WordPress administrator credentials and invalidate active sessions if the plugin was accessible to low-privilege users

Patch Information

No vendor patch is referenced in the CVE record. The advisory identifies vulnerable versions from n/a through 1.0. Monitor the Patchstack XSS Vulnerability Report and the plugin's WordPress.org page for updates.

Workarounds

Restrict post editing capabilities to trusted administrator accounts using role management plugins
Apply a virtual patch through a WordPress-aware WAF that filters script tags and event handlers within shortcode attributes
Replace the plugin with a maintained alternative that properly escapes shortcode output

bash

# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate horizontal-line-shortcode
wp plugin delete horizontal-line-shortcode

# Search post content for suspicious shortcode payloads
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[horizontal-line%' \
  AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%');"