CVE-2025-4168: WordPress Subpage List Plugin XSS Vulnerability

CVE-2025-4168 Overview

CVE-2025-4168 is a stored Cross-Site Scripting (XSS) vulnerability in the Subpage List plugin for WordPress. The flaw affects all versions up to and including 1.3.3. It exists in the plugin's subpages shortcode, which fails to properly sanitize input and escape output for user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript. The payload executes in the browser of any user who visits an affected page. The issue is classified under CWE-80 (Improper Neutralization of Script-Related HTML Tags).

Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in the context of site visitors and administrators, enabling session theft, forced actions, and content manipulation.

Affected Products

WordPress Subpage List plugin versions 1.3.3 and earlier
WordPress sites permitting Contributor-level or higher accounts
Any page rendering the plugin's subpages shortcode with attacker-controlled attributes

Discovery Timeline

2025-05-03 - CVE-2025-4168 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-4168

Vulnerability Analysis

The Subpage List plugin exposes a subpages shortcode implemented in class-subpage-list-shortcode.php. The shortcode accepts user-supplied attributes that are rendered back into the page output. The plugin does not apply WordPress sanitization helpers such as sanitize_text_field() on input, nor does it apply esc_attr() or esc_html() on output. As a result, an attacker able to place a shortcode in post content can embed HTML and JavaScript through crafted attribute values.

Exploitation requires authentication at the Contributor role or higher. Contributors can create draft posts containing shortcodes. When an editor or administrator previews or publishes the post, the injected script executes in their browser session. Because the payload is stored in the database and reflected each time the page renders, the impact persists across visitors.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attribute values inside the plugin's shortcode handler. See the plugin source at line 25 of class-subpage-list-shortcode.php for the affected rendering logic.

Attack Vector

The attack requires network access to the WordPress site and a valid low-privilege account. The attacker authors a post or page containing the subpages shortcode with malicious attribute values. When the content renders, the injected script executes in the victim's browser with the privileges of the viewing user. A successful attack against an administrator can lead to account takeover, plugin installation, or arbitrary PHP execution through the WordPress admin interface. Refer to the Wordfence advisory for additional exploitation context.

Detection Methods for CVE-2025-4168

Indicators of Compromise

Post or page content containing [subpages] shortcodes with attribute values that include <script>, on*= event handlers, or javascript: URIs
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages
New administrator accounts or modified user roles created without a corresponding audit trail
Modified theme or plugin files following a Contributor login session

Detection Strategies

Query the wp_posts table for shortcodes matching subpages and inspect attribute values for HTML or JavaScript content
Enable WordPress audit logging to correlate Contributor post submissions with subsequent administrator page views
Deploy a web application firewall rule that flags shortcode attributes containing script tags or event handler syntax

Monitoring Recommendations

Monitor for anomalous admin-area POST requests originating from unusual IP addresses or user agents
Alert on privilege changes, plugin installations, and user creation events in WordPress logs
Track browser telemetry for administrators, including unexpected script execution or cross-origin requests from /wp-admin/ pages

How to Mitigate CVE-2025-4168

Immediate Actions Required

Update the Subpage List plugin to a version later than 1.3.3 once the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin from affected WordPress installations
Audit all existing posts and pages for subpages shortcodes containing suspicious attribute values and remove malicious content
Rotate credentials for any administrator account that previewed or published contributor-authored content containing the shortcode

Patch Information

At the time of publication, the NVD entry references the vulnerable code in the plugin's trunk on WordPress Plugin Trac. Site owners should monitor the plugin's WordPress.org listing and the Wordfence advisory for release of a fixed version and apply the update immediately.

Workarounds

Restrict Contributor-level and above access to trusted users only, and remove unused accounts
Configure a web application firewall to block requests containing shortcode attributes with HTML or JavaScript payloads
Implement a Content Security Policy (CSP) that disallows inline scripts to limit the impact of stored XSS payloads
Disable the subpages shortcode via a custom mu-plugin calling remove_shortcode('subpages') until a patch is available

bash

# Disable the vulnerable shortcode via a must-use plugin
cat > wp-content/mu-plugins/disable-subpages-shortcode.php <<'EOF'
<?php
add_action('init', function () {
    remove_shortcode('subpages');
}, 20);
EOF