CVE-2025-24673: Ketchup Shortcodes Stored XSS Vulnerability

CVE-2025-24673 Overview

CVE-2025-24673 is a stored Cross-Site Scripting (XSS) vulnerability in the AyeCode Ketchup Shortcodes WordPress plugin (ketchup-shortcodes-pack). The flaw affects all versions up to and including 0.1.2 and stems from improper neutralization of script-related HTML tags. Authenticated attackers with low-privilege access can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The issue is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

Critical Impact
Attackers with contributor-level access can store malicious scripts that execute when administrators or visitors load the affected pages, enabling session theft and privileged action hijacking.

Affected Products

AyeCode Ketchup Shortcodes (ketchup-shortcodes-pack) WordPress plugin
All versions from initial release through 0.1.2
WordPress sites where the plugin is installed and active

Discovery Timeline

2025-01-24 - CVE-2025-24673 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24673

Vulnerability Analysis

The Ketchup Shortcodes plugin fails to sanitize user-controlled input processed through its shortcode handlers. Input containing <script> tags or equivalent script-loading HTML attributes is stored in the WordPress database without neutralization. When a page containing the malicious shortcode output renders, the browser executes the injected JavaScript in the context of the site origin.

Stored XSS carries higher impact than reflected variants because the payload persists across sessions. Any authenticated administrator or unauthenticated visitor loading the affected page triggers execution. The Common Weakness Enumeration classifies this as [CWE-80], covering basic XSS resulting from failure to filter script-related tags.

The scope change reflected in the vulnerability metrics indicates that exploitation crosses a trust boundary, typically from a lower-privileged contributor account to the administrator's browser session.

Root Cause

The root cause is the absence of output encoding and input sanitization in the shortcode rendering logic. WordPress provides sanitization helpers such as wp_kses_post() and esc_html(), but the affected plugin code paths do not invoke them before persisting or emitting user-supplied attribute values. This allows raw HTML — including <script>, <img onerror=>, and <iframe> constructs — to reach the DOM intact.

Attack Vector

Exploitation requires an authenticated account with permission to publish or edit content containing shortcodes. The attacker embeds a crafted shortcode carrying a script payload into a post, page, or widget. When any user with sufficient page access views the rendered content, the payload executes.

Because the attack requires user interaction (visiting the compromised page) and low-privilege authentication, the vector is primarily an insider or supply-chain risk on multi-author WordPress sites. Successful exploitation can result in session cookie theft, forced administrative actions via CSRF, plugin installation, or account takeover.

Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-24673

Indicators of Compromise

Post or page content containing <script>, onerror=, onload=, or javascript: strings inside Ketchup Shortcodes markup
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading wp-admin pages
New administrator accounts or plugin installations that do not correlate with legitimate admin activity
Modified wp_options entries or unfamiliar entries in the wp_posts table containing encoded script payloads

Detection Strategies

Audit WordPress post content for shortcode attributes containing HTML tags, event handlers, or URI schemes beyond expected values
Monitor web server logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor-level accounts that include script-like payloads
Deploy a Web Application Firewall (WAF) rule matching XSS signatures on requests targeting Ketchup Shortcodes endpoints

Monitoring Recommendations

Enable WordPress audit logging to capture post creation and edit events attributed to low-privilege users
Alert on browser-side Content Security Policy (CSP) violation reports originating from pages using Ketchup Shortcodes
Track privilege escalations and new administrator account creation events in near real time

How to Mitigate CVE-2025-24673

Immediate Actions Required

Deactivate and remove the Ketchup Shortcodes plugin until a patched release is confirmed available
Review all posts and pages authored by contributor or author accounts for embedded shortcodes containing HTML or script content
Force password resets for administrator accounts and rotate session cookies if the plugin has been active with untrusted authors
Audit the WordPress user table for unexpected administrator accounts and remove any that are unauthorized

Patch Information

As of the last NVD update on 2026-06-17, no fixed version is listed for Ketchup Shortcodes beyond 0.1.2. Consult the Patchstack advisory and the plugin repository for updated release information. If no patch is available, permanent removal is the recommended course of action.

Workarounds

Restrict shortcode-capable roles to trusted users only; revoke publishing rights from unverified contributor accounts
Deploy a WAF or virtual patch rule blocking script tags and inline event handlers within requests to plugin endpoints
Implement a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce exploit impact
Replace Ketchup Shortcodes functionality with an actively maintained alternative plugin

bash

# Example nginx WAF-style filter to block obvious script payloads in POST bodies
# targeting WordPress admin endpoints. Test in monitoring mode first.
location ~ ^/wp-admin/(post|admin-ajax)\.php$ {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}