CVE-2025-5084: Post Grid Master XSS Vulnerability

CVE-2025-5084 Overview

CVE-2025-5084 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Post Grid Master plugin for WordPress, published by Addonmaster. The flaw affects all versions up to and including 3.4.13 and stems from insufficient input sanitization and output escaping on the argsArray['read_more_text'] parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim is tricked into clicking a crafted link. The plugin is distributed via the ajax-filter-posts WordPress slug, and a patched release is available as version 3.4.14.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of a targeted user's browser session, enabling session theft, credential harvesting, and administrative account compromise through social engineering.

Affected Products

Addonmaster Post Grid Master plugin for WordPress (ajax-filter-posts)
All versions up to and including 3.4.13
WordPress sites with the plugin active and reachable over the network

Discovery Timeline

2025-07-24 - CVE-2025-5084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5084

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw classified under [CWE-79]. The Post Grid Master plugin accepts the read_more_text value inside the argsArray request parameter and reflects it into rendered HTML without adequate sanitization or contextual output escaping. Because the input is neither filtered with a WordPress sanitizer such as sanitize_text_field() nor escaped with esc_html() or esc_attr() at output, an attacker can supply an HTML or JavaScript payload that the plugin returns inline within the page response.

Exploitation requires user interaction: the victim must load a crafted URL that carries the attacker-controlled read_more_text value. Once loaded, the injected script runs in the origin of the vulnerable WordPress site. If the victim is an authenticated administrator, the payload can perform privileged actions such as creating new admin users, modifying plugin settings, or exfiltrating session cookies.

Root Cause

The root cause is missing input validation and output escaping in the plugin's rendering path, located in inc/functions.php within the ajax-filter-posts source tree. Comparing the vulnerable 3.4.13 release with the patched 3.4.14 release shows the maintainer added escaping around the read_more_text value before it is emitted into HTML output.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL that targets an endpoint of a vulnerable site and embeds a malicious payload in the argsArray[read_more_text] parameter. The attacker then distributes the URL through phishing email, forum posts, chat messages, or malicious advertisements. When a victim clicks the link, the payload is reflected into the response HTML and executed by the browser under the vulnerable site's origin.

The vulnerability mechanism is described in the Wordfence Vulnerability Analysis and demonstrated in a public GitHub PoC Repository. Source-level differences are visible between the WordPress Plugin Code Review 3.4.13 and the WordPress Plugin Code Review 3.4.14.

Detection Methods for CVE-2025-5084

Indicators of Compromise

HTTP requests containing the argsArray[read_more_text] parameter with values including <script>, onerror=, onload=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers from external domains driving traffic to plugin endpoints exposed by ajax-filter-posts.
Anomalous outbound requests from browsers of authenticated WordPress administrators shortly after visiting a link to the site.
Unexpected creation of WordPress administrator accounts or plugin configuration changes following user clicks on external links.

Detection Strategies

Inspect web server access logs for query strings containing argsArray combined with HTML tags or JavaScript event handlers.
Deploy Web Application Firewall (WAF) rules that flag reflected script patterns in parameters targeting /wp-admin/admin-ajax.php and plugin front-end endpoints.
Correlate browser telemetry from administrator endpoints with WordPress audit logs to identify script execution originating from crafted URLs.
Enumerate installed WordPress plugins across the estate and flag any host running ajax-filter-posts at version 3.4.13 or earlier.

Monitoring Recommendations

Continuously monitor WordPress plugin inventory and version state for the Post Grid Master plugin.
Alert on new administrative user creation, role changes, and theme or plugin edits performed shortly after a session visits an external referrer.
Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts.

How to Mitigate CVE-2025-5084

Immediate Actions Required

Upgrade the Post Grid Master plugin to version 3.4.14 or later on all WordPress instances.
Audit WordPress administrator accounts, active sessions, and application passwords for unauthorized additions or changes.
Review web server logs for prior exploitation attempts targeting the argsArray[read_more_text] parameter.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is present.

Patch Information

The vendor addressed the vulnerability in Post Grid Master version 3.4.14 by adding proper sanitization and output escaping for the read_more_text value. Update via the WordPress plugin dashboard or by replacing the plugin files with the current release from WordPress Plugin Developer Information.

Workarounds

Deactivate and remove the Post Grid Master plugin until the update to 3.4.14 can be applied.
Deploy WAF signatures that block requests containing HTML or JavaScript payloads in argsArray[read_more_text].
Enforce a strict Content Security Policy that disallows inline scripts to reduce reflected XSS execution impact.
Restrict administrative access to trusted IP ranges and require multi-factor authentication for WordPress administrators.

bash

# Configuration example: update Post Grid Master via WP-CLI
wp plugin update ajax-filter-posts --version=3.4.14
wp plugin list --name=ajax-filter-posts --fields=name,status,version