CVE-2025-4586: IRM Newsroom WordPress Plugin XSS Vulnerability

CVE-2025-4586 Overview

The IRM Newsroom plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 1.2.19. The flaw resides in the plugin's irmcalendarview shortcode, which fails to properly sanitize input and escape output on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The vulnerability was published to the National Vulnerability Database (NVD) on June 13, 2025.

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative action hijacking, and drive-by redirects against site visitors and administrators.

Affected Products

IRM Newsroom plugin for WordPress, all versions through 1.2.19
WordPress sites using the irmcalendarview shortcode
Vendor: irmau

Discovery Timeline

2025-06-13 - CVE-2025-4586 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4586

Vulnerability Analysis

The IRM Newsroom plugin exposes a shortcode named irmcalendarview that accepts user-supplied attributes and renders them into the resulting HTML. The plugin does not apply input sanitization on those attributes and does not escape them before output. Because shortcodes can be inserted into post and page content by contributors, any user with contributor privileges or higher can embed malicious payloads.

When a visitor loads a page containing the poisoned shortcode, the injected script executes in the visitor's browser under the site's origin. If an administrator triggers the payload, the attacker gains the ability to perform authenticated actions on the administrator's behalf, including creating accounts, modifying plugin settings, or planting persistent backdoors.

Root Cause

The root cause is missing input validation and missing output escaping in the shortcode handler defined in irm-newsroom.php. Attribute values pass through the render logic without calls to WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses(). The relevant handler is referenced in the WordPress Plugin Code Review.

Attack Vector

An authenticated attacker with contributor role or higher creates or edits a post containing the irmcalendarview shortcode with a crafted attribute value that includes JavaScript. The payload is stored in the WordPress database. When any user views the page, the browser parses and executes the script. Exploitation requires user interaction, as the target must load the compromised page. The stored nature of the flaw allows repeated triggering against multiple victims.

No verified public exploit or proof-of-concept has been published. See the Wordfence Vulnerability Report for advisory details.

Detection Methods for CVE-2025-4586

Indicators of Compromise

Post or page content containing the irmcalendarview shortcode with attribute values that include <script>, javascript:, or HTML event handlers such as onerror, onload, or onclick
Newly created administrator accounts or unexpected privilege changes following contributor activity
Outbound requests from visitor browsers to unfamiliar external domains when loading pages that use the shortcode

Detection Strategies

Query the WordPress wp_posts table for post_content values matching irmcalendarview combined with script-related tokens
Review WordPress audit logs for contributor accounts publishing or editing content containing the vulnerable shortcode
Inspect Content Security Policy (CSP) violation reports for inline script executions originating from pages that render the plugin's calendar view

Monitoring Recommendations

Enable a web application firewall (WAF) rule set that inspects stored content for XSS payloads within shortcode attributes
Monitor changes to the installed version of the IRM Newsroom plugin and alert when it remains at 1.2.19 or earlier
Track contributor and author role activity, particularly bulk post edits or shortcode-heavy content submissions

How to Mitigate CVE-2025-4586

Immediate Actions Required

Update the IRM Newsroom plugin to a version later than 1.2.19 that includes the fix referenced in the WordPress Plugin Changeset Update
Audit all posts and pages for existing use of the irmcalendarview shortcode and remove any suspicious attribute values
Review contributor, author, and editor accounts, rotating credentials for any accounts showing unexpected activity

Patch Information

The vendor addressed the vulnerability in the code committed in changeset 3312832. Site administrators should install the updated plugin release from the WordPress plugin repository. Refer to the WordPress Plugin Changeset Update for the specific code changes that introduced sanitization and escaping on shortcode attributes.

Workarounds

Deactivate and remove the IRM Newsroom plugin until the patched version can be deployed
Restrict contributor-level and higher account provisioning to trusted users only
Deploy a WAF rule that blocks HTTP POST requests to wp-admin/post.php containing irmcalendarview combined with script tags or event handlers
Apply a strict Content Security Policy that disallows inline script execution on public-facing pages

bash

# Configuration example: locate vulnerable shortcode usage via WP-CLI
wp post list --post_type=any --format=ids \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -l "irmcalendarview"