CVE-2025-3748: Taxonomy Chain Menu XSS Vulnerability

CVE-2025-3748 Overview

CVE-2025-3748 is a Stored Cross-Site Scripting (XSS) vulnerability in the Taxonomy Chain Menu plugin for WordPress, developed by Pluginus. The flaw affects all plugin versions up to and including 1.0.8. The vulnerability resides in the pn_chain_menu shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The malicious payload executes in the browser of any user who views the affected page.

Critical Impact
Contributor-level accounts can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, admin action forgery, and site defacement.

Affected Products

Pluginus Taxonomy Chain Menu plugin for WordPress — all versions through 1.0.8
WordPress sites allowing contributor-level or higher user registration
Any WordPress installation rendering the pn_chain_menu shortcode

Discovery Timeline

2025-05-02 - CVE-2025-3748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3748

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under [CWE-79]. The Taxonomy Chain Menu plugin exposes the pn_chain_menu shortcode, which accepts user-controlled attributes. The plugin fails to apply input sanitization on those attributes and does not escape them when rendered in HTML output. A contributor who embeds the shortcode with a crafted attribute value can inject arbitrary script content. The injected payload is stored in the post or page and executed each time a visitor loads the affected page.

Because exploitation requires user interaction and only contributor-level authentication, the impact is bounded but material. Payloads run in the context of the site origin, granting access to cookies and Document Object Model (DOM) content available to the victim. When an administrator views the compromised page, attackers can pivot to privileged actions such as creating new admin accounts or modifying plugin settings.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attributes handled in the plugin source, referenced at line 190 of index.php in the plugin trunk. WordPress provides helper functions such as esc_attr(), esc_html(), and wp_kses() for this purpose, none of which were applied to the vulnerable attribute path. See the WordPress Plugin Code Reference for the affected code location.

Attack Vector

An authenticated attacker with contributor privileges creates or edits a post that includes the pn_chain_menu shortcode with a malicious attribute value containing JavaScript. Once the post is published or previewed by a higher-privileged user, the stored payload executes in that user's browser session. The attack traverses a scope boundary from contributor content to administrator context, matching the CVSS S:C (scope changed) classification.

See the Wordfence Vulnerability Report for additional technical details. No public proof-of-concept exploit code is currently referenced in the NVD entry.

Detection Methods for CVE-2025-3748

Indicators of Compromise

Post or page content containing the pn_chain_menu shortcode with attribute values that include <script>, javascript:, or HTML event handlers such as onerror= and onload=.
Unexpected outbound requests from administrator browser sessions to unfamiliar domains after viewing plugin-rendered pages.
New WordPress administrator accounts or role changes correlated with contributor activity in the audit log.

Detection Strategies

Query the wp_posts table for post_content entries containing pn_chain_menu combined with script tags, on*= event handler patterns, or javascript: URIs.
Review WordPress activity logs for contributor-level users creating or editing posts that render plugin shortcodes.
Monitor web server access logs for anomalous requests originating from admin-authenticated sessions to third-party hosts.

Monitoring Recommendations

Enable a Content Security Policy (CSP) that restricts inline script execution and log CSP violation reports for review.
Track plugin version inventory across WordPress sites and alert when Taxonomy Chain Menu is present at version 1.0.8 or earlier.
Alert on new user role escalations to administrator or editor immediately after contributor content is published.

How to Mitigate CVE-2025-3748

Immediate Actions Required

Update the Taxonomy Chain Menu plugin to a version later than 1.0.8 that contains the fix from WordPress Changeset 3284354.
If no updated version is installed, deactivate and remove the plugin until a patch is applied and verified.
Audit all contributor and author accounts for unfamiliar users, and review recent post content for injected shortcode attributes.

Patch Information

The vendor addressed the issue in the plugin repository via WordPress Changeset 3284354, which introduces sanitization and escaping on the affected shortcode attributes. Site administrators should update through the WordPress plugin manager. Reference the WordPress Plugin Developer Info page to confirm the fixed release version.

Workarounds

Restrict contributor-level content creation to trusted users only, and require editor review before publication.
Deploy a web application firewall (WAF) rule that inspects post submissions for pn_chain_menu shortcodes containing script content or event-handler attributes.
Enforce a strict Content Security Policy that blocks inline JavaScript, mitigating execution of injected payloads.

bash

# Example WP-CLI command to identify vulnerable plugin installations
wp plugin list --name=taxonomy-chain-menu --fields=name,status,version

# Deactivate the plugin site-wide until patched
wp plugin deactivate taxonomy-chain-menu