CVE-2025-4099: List Children WordPress Plugin XSS Vulnerability

CVE-2025-4099 Overview

The List Children plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.1. The flaw resides in the plugin's list_children shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who views the affected page. The issue is tracked under CWE-79 and was addressed in WordPress plugin changeset 3284430.

Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, credential capture, and administrator account takeover through browser-based attacks.

Affected Products

Sizeable List Children plugin for WordPress, all versions through 2.1
WordPress sites permitting contributor-level or higher registration
Any WordPress installation rendering the list_children shortcode

Discovery Timeline

2025-05-01 - CVE-2025-4099 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4099

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the list_children shortcode handler of the List Children WordPress plugin. The shortcode accepts user-supplied attributes and renders them into page HTML without sufficient sanitization or output escaping. An authenticated attacker with contributor privileges can embed a malicious shortcode invocation containing JavaScript payloads within a post or page. When any visitor loads the rendered page, the injected script executes in their browser context.

Because the payload persists in the WordPress database, every subsequent view of the affected page triggers the script. Successful exploitation can lead to session hijacking, forced administrative actions via the victim's authenticated session, redirection to attacker-controlled infrastructure, and delivery of secondary malware. The CVSS scope change reflects the ability of injected scripts to affect resources beyond the vulnerable component, such as administrator sessions.

Root Cause

The plugin's shortcode processing logic does not apply WordPress sanitization functions such as sanitize_text_field() on incoming attributes, nor does it escape output through helpers like esc_html() or esc_attr() before echoing values into the page. The plugin source is available at list_children.php line 26. This is a classic input validation failure classified as CWE-79: Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires network access to the target WordPress site and an authenticated account at contributor level or above. The attacker crafts a post containing the list_children shortcode with attribute values weaponized to break out of the intended HTML context. After the post is saved and published, or previewed by a higher-privileged user such as an editor or administrator, the payload executes in that reviewer's authenticated session. User interaction (viewing the page) is required to trigger execution.

See the Wordfence vulnerability analysis for additional context on the exploitation path.

Detection Methods for CVE-2025-4099

Indicators of Compromise

Posts or pages containing list_children shortcode invocations with attribute values that include HTML tags, on* event handlers, or javascript: URIs
Unexpected <script> tags, iframes, or external resource references rendered on pages using the shortcode
New administrator accounts, unexpected plugin installs, or theme edits following contributor content submissions
Outbound requests from administrator browsers to unfamiliar domains after viewing contributor-authored pages

Detection Strategies

Audit the wp_posts table for shortcode invocations containing suspicious characters such as <, >, ", or javascript: inside attribute values
Deploy a Web Application Firewall (WAF) rule that inspects requests to /wp-admin/post.php for list_children attributes containing HTML or script constructs
Enable a Content Security Policy (CSP) in report-only mode to surface inline script executions on public pages
Review WordPress user role assignments and correlate contributor account creation with subsequent post activity

Monitoring Recommendations

Log and alert on all shortcode edits made by contributor-level accounts prior to editorial review
Monitor browser telemetry from administrator workstations for anomalous script executions on WordPress admin previews
Track plugin version inventory across managed WordPress sites to identify installations still running List Children 2.1 or earlier

How to Mitigate CVE-2025-4099

Immediate Actions Required

Update the List Children plugin to the version published in changeset 3284430 or later
Review all published and draft pages containing the list_children shortcode for malicious attribute values and remove any injected payloads
Audit contributor and author accounts, disabling any that were created without a legitimate business need
Rotate administrator credentials and invalidate active sessions if suspicious shortcode content is discovered

Patch Information

The vendor addressed the vulnerability by adding input sanitization and output escaping to the list_children shortcode handler. The fix is committed in WordPress plugin repository changeset 3284430. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI. No supported version below the patched release remains safe to run.

Workarounds

Deactivate and remove the List Children plugin until the patched version can be deployed
Restrict contributor-level registration and require editor approval before publishing any content containing shortcodes
Deploy a WAF rule blocking POST requests to WordPress editing endpoints that contain list_children attributes with HTML metacharacters
Enforce a strict Content Security Policy that disallows inline scripts on public-facing WordPress pages

bash

# Update the plugin using WP-CLI
wp plugin update list-children

# Verify installed version
wp plugin get list-children --field=version

# If a patched version is not yet available, deactivate the plugin
wp plugin deactivate list-children