CVE-2025-4608 Overview
The Structured Content plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the sc_fs_local_business shortcode. The flaw affects all versions up to and including 1.6.4. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. The injected payloads execute in the browser of any visitor who accesses the affected page. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can persist JavaScript payloads in WordPress pages, enabling session theft, administrator account takeover, and drive-by malware delivery to site visitors.
Affected Products
- Structured Content plugin for WordPress, versions up to and including 1.6.4
- WordPress sites permitting contributor-level or higher user registration
- Any published page or post rendering the sc_fs_local_business shortcode
Discovery Timeline
- 2025-07-24 - CVE-2025-4608 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4608
Vulnerability Analysis
The Structured Content plugin exposes the sc_fs_local_business shortcode to authors and contributors composing WordPress content. Attributes passed to the shortcode are rendered directly into the page template without sufficient sanitization or context-aware output escaping. An attacker with contributor privileges can craft shortcode attributes containing HTML event handlers or <script> payloads that persist in the database. When the target page is rendered, the browser executes the injected JavaScript in the origin of the WordPress site.
Because the payload is stored, exploitation does not require social engineering of individual victims. Any authenticated administrator or unauthenticated visitor loading the affected page triggers script execution. The scope change reflects that scripts run in the trusted context of the WordPress site, granting access to cookies, session tokens, and Document Object Model (DOM) state accessible to the victim.
Root Cause
The root cause is missing input sanitization and missing output escaping in the shortcode handler. The plugin's shortcode registration in class-structuredcontent.php and the template file templates/shortcodes/local-business.php pass user-controlled attribute values to page output without applying functions such as esc_attr(), esc_html(), or wp_kses(). This aligns with [CWE-79]. Details are available in the WordPress Plugin Source Code and WordPress Template Source Code.
Attack Vector
An attacker first obtains contributor-level access, either through open registration or credential compromise. The attacker inserts the sc_fs_local_business shortcode into a post or page and supplies malicious values in one or more attributes. After the content is saved and published, the payload executes whenever the page is rendered. The Wordfence Vulnerability Report documents the attack path.
No verified public exploitation code is available; the vulnerability is described in prose based on the vendor advisory and source code references.
Detection Methods for CVE-2025-4608
Indicators of Compromise
- Post or page content containing sc_fs_local_business shortcode attributes with <script> tags, on* event handlers, or javascript: URIs.
- New or recently modified WordPress posts authored by contributor accounts that include unexpected inline HTML or JavaScript.
- Outbound browser requests from site visitors to unfamiliar domains when loading pages that render the shortcode.
Detection Strategies
- Query the wp_posts table for shortcode occurrences: SELECT ID, post_author FROM wp_posts WHERE post_content LIKE '%sc_fs_local_business%'; and review attribute values for HTML metacharacters.
- Deploy a Web Application Firewall (WAF) rule that inspects post save requests for shortcode attributes containing <, >, or on event-handler patterns.
- Use Content Security Policy (CSP) violation reports to surface unexpected inline script execution on public pages.
Monitoring Recommendations
- Audit contributor and author account creation and correlate with new posts using the vulnerable shortcode.
- Monitor plugin version inventory across WordPress estates and alert when Structured Content <= 1.6.4 is present.
- Log administrator sessions and review for anomalous actions that could indicate cookie theft following an XSS execution.
How to Mitigate CVE-2025-4608
Immediate Actions Required
- Update the Structured Content plugin to the patched release published in WordPress Changeset 3334624.
- Audit existing posts and pages for the sc_fs_local_business shortcode and remove any attributes containing HTML or scripting content.
- Review contributor and author accounts, disable unused accounts, and rotate credentials for accounts suspected of abuse.
Patch Information
The plugin vendor addressed the flaw by adding input sanitization and output escaping to the affected shortcode template. Users should install the version referenced in the WordPress Plugin Developer Resources. Verify the installed version in the WordPress admin under Plugins after the update completes.
Workarounds
- Deactivate the Structured Content plugin until the patched version is deployed.
- Restrict user registration and remove contributor-level privileges from untrusted accounts.
- Enforce a strict Content Security Policy that disallows inline scripts on public pages to reduce exploit impact.
# Update the Structured Content plugin using WP-CLI
wp plugin update structured-content
wp plugin get structured-content --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
