CVE-2025-4126: EG-Series WordPress Plugin XSS Vulnerability

CVE-2025-4126 Overview

CVE-2025-4126 is a Stored Cross-Site Scripting (XSS) vulnerability in the EG-Series plugin for WordPress. The flaw affects all versions up to and including 2.1.1. It exists in the shortcode_title function, which fails to properly sanitize input and escape output on user-supplied attributes of the [series] shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript through the titletag attribute on sites running the Classic Editor plugin. The injected script executes in the browser of any user who visits an affected page. The vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Critical Impact
Contributor-level attackers can persist JavaScript in shortcode attributes that runs against every visitor, enabling session theft, account takeover, and administrative action abuse.

Affected Products

EG-Series plugin for WordPress, all versions through 2.1.1
WordPress sites with the Classic Editor plugin activated
Any WordPress installation permitting contributor-level or higher accounts

Discovery Timeline

2025-05-15 - CVE-2025-4126 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4126

Vulnerability Analysis

The vulnerability resides in the shortcode_title function within the EG-Series plugin source file lib/eg-plugin.inc.php. The function accepts user-controlled attributes passed through the [series] shortcode without validating or escaping their contents. The titletag attribute is rendered directly into the HTML output. An authenticated contributor can embed the shortcode in a draft post and set titletag to a payload containing JavaScript. When the post is previewed, submitted for review, or published, the script executes in the browser context of the visitor. Administrators reviewing contributor submissions are common targets, since script execution in their session enables privilege escalation through account or content manipulation.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode_title handler. The plugin does not apply WordPress functions such as esc_attr() or esc_html() to shortcode attribute values before echoing them into the page markup. The Classic Editor prerequisite exists because the Block Editor performs some sanitization on shortcode content that neutralizes the payload.

Attack Vector

Exploitation requires an authenticated account at contributor level or above. The attacker crafts a post containing a [series titletag="..."] shortcode where the attribute value includes JavaScript in an event handler or nested tag. Once the content is rendered, the payload runs against any authenticated user who loads the page. The scope-changed impact reflects that stored payloads can affect users beyond the attacker's privilege boundary, including editors and administrators.

See the WordPress Plugin Source Code and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-4126

Indicators of Compromise

Posts, pages, or revisions containing [series] shortcodes with titletag attributes holding HTML tags, event handlers (onerror, onload, onmouseover), or javascript: URIs
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after reviewing contributor submissions
New administrator accounts, altered user roles, or unauthorized plugin installations following contributor activity

Detection Strategies

Search the wp_posts table for shortcode patterns matching [series combined with <script, on\w+=, or javascript: values
Review web server access logs for administrator sessions triggering unexpected admin-ajax.php or REST API calls immediately after loading contributor content
Audit the plugin version reported by wp plugin list and flag installations at 2.1.1 or earlier

Monitoring Recommendations

Enable WordPress audit logging for post creation, revision, and role change events
Alert on contributor accounts whose drafts contain shortcode attributes with HTML metacharacters
Monitor Content Security Policy (CSP) violation reports for inline script execution on post preview pages

How to Mitigate CVE-2025-4126

Immediate Actions Required

Deactivate the EG-Series plugin on any WordPress site running version 2.1.1 or earlier until a patched release is confirmed
Restrict contributor and author role assignments to trusted users and review recent role provisioning
Purge existing posts and revisions containing [series] shortcodes with suspicious titletag values

Patch Information

As of the last NVD update on 2026-06-17, no fixed version is listed in the enriched data. Administrators should consult the Wordfence Vulnerability Report and the WordPress Plugin Repository for the current release status and apply any patched version once available.

Workarounds

Disable the EG-Series plugin or remove the [series] shortcode registration until a fix is available
Switch from the Classic Editor to the Block Editor, which neutralizes the shortcode attribute injection path
Enforce a strict Content Security Policy that blocks inline script execution on rendered post pages
Deploy a Web Application Firewall (WAF) rule that inspects post submissions for shortcode attributes containing HTML tags or event handlers

bash

# Configuration example: locate vulnerable content via WP-CLI
wp post list --post_status=any --format=ids \
  | xargs -I{} wp post get {} --field=post_content \
  | grep -E '\[series[^]]*titletag="[^"]*(<|on[a-z]+=|javascript:)'

# Temporarily deactivate the plugin site-wide
wp plugin deactivate eg-series