CVE-2025-4584: IRM Newsroom WordPress Plugin XSS Vulnerability

CVE-2025-4584 Overview

The IRM Newsroom plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the irmeventlist shortcode. All versions up to and including 1.2.19 fail to sanitize user-supplied shortcode attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page. The flaw is tracked as [CWE-79] and affects the irmau/irm_newsroom plugin distributed through the WordPress.org repository.

Critical Impact
Contributor-level accounts can persist arbitrary JavaScript in WordPress pages, enabling session theft, admin action forgery, and cross-site content manipulation against every visitor.

Affected Products

IRM Newsroom plugin for WordPress, versions * through 1.2.19
Vendor: irmau
CPE: cpe:2.3:a:irmau:irm_newsroom:*:*:*:*:*:wordpress:*:*

Discovery Timeline

2025-06-13 - CVE-2025-4584 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4584

Vulnerability Analysis

The vulnerability resides in the irmeventlist shortcode handler in irm-newsroom.php. The handler accepts attributes from shortcode invocations and renders them back into page HTML without applying input sanitization or output escaping. Because WordPress allows contributors to author posts containing shortcodes, an attacker with contributor privileges can craft a shortcode invocation whose attribute values contain HTML or JavaScript payloads. Once the post is previewed, submitted for review, or published, the payload executes in the browser context of any authenticated user, including administrators and site editors.

Exploitation requires user interaction because a victim must load the injected page. However, the scope is changed: the injected script runs in the origin of the WordPress site, giving the attacker access to authenticated session cookies, nonces, and the REST API surface accessible to the viewing user.

Root Cause

The plugin reflects shortcode attribute values into HTML output without calling standard WordPress sanitization primitives such as sanitize_text_field(), esc_attr(), or esc_html(). The affected source path is documented in the WordPress Plugin Source Code. This is a classic [CWE-79] Improper Neutralization of Input During Web Page Generation defect.

Attack Vector

An authenticated contributor writes a post containing the irmeventlist shortcode with a malicious attribute value. The attribute closes the surrounding HTML context and injects a <script> tag or event handler. When an administrator reviews or publishes the post, the payload fires with the administrator's session, enabling privileged actions such as creating new admin accounts or modifying plugin settings. The vulnerability does not require exploit tooling; a single crafted shortcode is sufficient.

No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-4584

Indicators of Compromise

Post or page content containing [irmeventlist ...] shortcodes with attribute values that include <script, onerror=, onload=, javascript:, or encoded variants such as <script.
Unexpected outbound requests from browser sessions of administrators visiting content authored by contributor accounts.
New administrator accounts, modified user roles, or plugin/theme changes shortly after a contributor publishes or updates content.

Detection Strategies

Query the WordPress wp_posts table for post_content matching the irmeventlist shortcode combined with HTML tag characters or JavaScript event handler patterns.
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to wp-admin/post.php for shortcode attributes containing script markup.
Review contributor and author activity logs for posts submitted for review that contain the vulnerable shortcode.

Monitoring Recommendations

Alert on creation or promotion of WordPress user accounts, particularly role changes to administrator or editor.
Log and review REST API calls to /wp-json/wp/v2/users and /wp-json/wp/v2/posts originating from browser sessions rather than server-side integrations.
Monitor plugin file integrity for irm-newsroom.php and verify the installed version against fixed releases.

How to Mitigate CVE-2025-4584

Immediate Actions Required

Update the IRM Newsroom plugin to the version containing WordPress Changeset 3312832, which addresses the sanitization gap.
Audit all existing posts and pages for use of the irmeventlist shortcode and review attribute values for injected markup.
Restrict contributor-level account provisioning and enforce multi-factor authentication for any account able to author content.

Patch Information

The vendor addressed the vulnerability in the commit tracked as WordPress Changeset 3312832. Details of the fix and impact analysis are available in the Wordfence Vulnerability Report. Administrators should upgrade to the first release published after 1.2.19 that includes this changeset.

Workarounds

Deactivate and remove the IRM Newsroom plugin until the patched version can be deployed.
Remove the unfiltered_html capability from all non-administrator roles and audit which roles can use shortcodes.
Deploy a WAF rule that blocks shortcode attributes containing <, >, or javascript: when submitted to WordPress post endpoints.

bash

# Configuration example: identify the vulnerable shortcode across the database
wp db query "SELECT ID, post_title, post_status, post_author FROM wp_posts \
  WHERE post_content LIKE '%[irmeventlist%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');

# Confirm the installed plugin version and update
wp plugin get irm-newsroom --field=version
wp plugin update irm-newsroom