CVE-2025-3750: WordPress Network Posts Extended XSS Flaw

CVE-2025-3750 Overview

CVE-2025-3750 is a Stored Cross-Site Scripting (XSS) vulnerability in the Network Posts Extended plugin for WordPress. The flaw affects all versions up to and including 7.7.1. It exists in the post_height parameter, which lacks sufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads an affected page. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Contributor-level users can persist malicious JavaScript that runs in the context of site visitors and administrators, enabling session theft, account takeover, and defacement.

Affected Products

• Network Posts Extended plugin for WordPress
• All versions up to and including 7.7.1
• WordPress sites permitting Contributor-level or higher registrations

Discovery Timeline

• 2025-05-21 - CVE-2025-3750 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3750

Vulnerability Analysis

The Network Posts Extended plugin accepts a post_height parameter that is rendered back into the page markup without adequate sanitization or output escaping. Because the value flows into HTML output unchanged, an attacker can supply a payload containing script markup or event handlers. The injected content is stored server-side and served to subsequent visitors, making this a stored (persistent) XSS rather than a reflected variant.

Exploitation requires only a Contributor account, a role commonly granted on multi-author WordPress deployments. The scope is marked as changed, meaning the injected script executes in the browser context of other users, including administrators viewing the affected content.

Root Cause

The root cause is missing input validation on the post_height parameter combined with the absence of contextual output escaping (for example, esc_attr() or esc_html()) when the value is rendered. The vulnerable code path is present in the plugin's main file network-posts-extended.php. See the WordPress Plugin Source Code for the affected line.

Attack Vector

An authenticated attacker with Contributor privileges submits a crafted value for the post_height parameter through the plugin's post configuration interface. The payload is stored in the database and rendered when any user loads a page that includes the affected block. The script executes with the DOM permissions of the viewing user, enabling cookie theft, forced administrative actions via CSRF, or redirection to attacker-controlled infrastructure. Refer to the Wordfence Vulnerability Report for additional technical context.

No public proof-of-concept exploit code has been published for this issue, and no synthetic code example is included here.

Detection Methods for CVE-2025-3750

Indicators of Compromise

• Post metadata or plugin configuration entries containing <script>, onerror=, onload=, or javascript: payloads in the post_height field.
• Unexpected outbound requests from administrator browsers to unknown domains following page loads.
• New or modified administrator accounts created shortly after a Contributor viewed or edited a post using the plugin.

Detection Strategies

• Audit the WordPress wp_posts and wp_postmeta tables for non-numeric values in post_height fields associated with the plugin.
• Deploy a web application firewall rule to flag HTTP POST requests where post_height contains angle brackets or JavaScript event handlers.
• Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages rendering Network Posts Extended blocks.

Monitoring Recommendations

• Enable WordPress audit logging to track Contributor and Author actions that create or modify posts using this plugin.
• Correlate authentication events with content changes to identify low-privilege accounts producing suspicious markup.
• Alert on administrator session token reuse from unfamiliar IP addresses or user agents after a page render event.

How to Mitigate CVE-2025-3750

Immediate Actions Required

• Update the Network Posts Extended plugin to a version later than 7.7.1 once the vendor publishes a fix.
• Review all existing posts and plugin configuration for injected script content in the post_height parameter.
• Restrict Contributor-level registrations on public-facing WordPress sites until a patch is applied.

Patch Information

At the time of publication, no fixed version is confirmed in the NVD entry. Monitor the WordPress Plugin Developer Info page and the Wordfence Vulnerability Report for release status.

Workarounds

• Deactivate and remove the Network Posts Extended plugin until a patched release is available.
• Enforce a strict Content Security Policy that disallows inline scripts on pages that render plugin output.
• Downgrade untrusted Contributor accounts or require editorial review before content is published.

# WP-CLI: deactivate the vulnerable plugin across a multisite network
wp plugin deactivate network-posts-extended --network

# Audit postmeta for suspicious post_height values
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key='post_height' AND meta_value REGEXP '<|javascript:|on[a-z]+=';"