CVE-2025-3749 Overview
The Breeze Display plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the cal_size parameter. The flaw affects all plugin versions up to and including 1.2.3. Insufficient input sanitization and output escaping in the shortcode handler allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. The injected scripts execute in the browser of any visitor viewing the affected page. This weakness maps to [CWE-79], improper neutralization of input during web page generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, admin account takeover, and site defacement.
Affected Products
- WordPress Breeze Display plugin (wt-display-breeze) versions ≤ 1.2.3
- WordPress sites accepting Contributor-level registrations that install this plugin
- Multisite WordPress installations sharing the vulnerable plugin
Discovery Timeline
- 2025-04-24 - CVE-2025-3749 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3749
Vulnerability Analysis
The vulnerability resides in the plugin's shortcode handler located in includes/shortcodes.php. The handler accepts a cal_size attribute from user-supplied shortcode input and renders the value into the page output without applying sanitization functions such as esc_attr() or sanitize_text_field(). Because the shortcode is processed when a post or page is rendered, malicious content persists in the database and executes each time the affected page loads. Any WordPress user role permitted to author posts containing shortcodes, including Contributors, can insert the payload. The stored nature of the flaw increases its impact compared to reflected XSS because a single injection affects every subsequent visitor.
Root Cause
The plugin trusts shortcode attribute values supplied by post authors. The cal_size parameter is echoed into the generated HTML without escaping, allowing an attacker to break out of the intended attribute context and inject arbitrary <script> content or event handlers. Details of the affected code path are available in the WordPress Shortcode Code Review.
Attack Vector
An attacker registers or compromises an account with Contributor-level access or above. The attacker publishes or submits a post containing the vulnerable shortcode with a crafted cal_size value that closes the surrounding HTML attribute and appends JavaScript. When an editor, administrator, or public visitor views the post, the browser executes the payload under the site's origin. The Wordfence analysis of this issue is documented in the Wordfence Vulnerability Analysis.
No verified proof-of-concept code is published. The vulnerability mechanism is described above; refer to the linked technical references for the affected source line.
Detection Methods for CVE-2025-3749
Indicators of Compromise
- Post or page content containing the Breeze Display shortcode with cal_size attribute values that include <script>, onerror=, onload=, or javascript: strings
- New or existing Contributor-level accounts publishing content containing the plugin's shortcodes shortly after registration
- Outbound browser requests from administrator sessions to unexpected external domains after viewing plugin-rendered pages
Detection Strategies
- Query the wp_posts table for post_content values matching the plugin shortcode combined with suspicious cal_size payloads
- Enable a Content Security Policy in report-only mode and review violation reports for inline script execution on pages using the plugin
- Review web server access logs for POST requests to wp-admin/post.php from Contributor accounts that include shortcode markup with unusual attribute values
Monitoring Recommendations
- Alert on creation or modification of posts that embed <script> fragments inside shortcode attributes
- Monitor privileged session activity for signs of forced actions such as user creation, plugin installation, or option changes originating from post preview pages
- Track installations of the wt-display-breeze plugin across managed WordPress sites and flag versions ≤ 1.2.3
How to Mitigate CVE-2025-3749
Immediate Actions Required
- Update the Breeze Display plugin to the version released in WordPress Changeset #3280146, which addresses the sanitization gap
- Audit all existing posts and pages that use the plugin's shortcode and remove any suspicious cal_size values
- Rotate credentials and invalidate active sessions for administrator accounts that may have viewed compromised content
- Review Contributor and Author accounts, removing untrusted or dormant users
Patch Information
The vendor addressed the vulnerability in the WordPress plugin repository. Deployment details are recorded in WordPress Changeset #3280146, and release information is available on the WT Display Breeze Plugin Dev Info page. Install any release later than 1.2.3 to receive the fix.
Workarounds
- Deactivate the Breeze Display plugin until the patched version is installed
- Restrict content publication rights so only trusted Editor and Administrator roles can create posts containing shortcodes
- Deploy a web application firewall rule that blocks shortcode submissions containing <script>, on*= handlers, or javascript: in the cal_size attribute
- Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.