CVE-2025-5237: WordPress Target Video Easy Publish XSS Flaw

CVE-2025-5237 Overview

The Target Video Easy Publish plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.8.5. The flaw resides in how the plugin handles the width parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected page. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) on June 18, 2025.

Critical Impact
Authenticated contributors can persistently inject JavaScript into WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when higher-privileged users view the injected content.

Affected Products

Target Video Easy Publish plugin (brid-video-easy-publish) for WordPress
All plugin versions up to and including 3.8.5
WordPress sites permitting Contributor-level or higher user registration

Discovery Timeline

2025-06-18 - CVE-2025-5237 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5237

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the Brid Shortcode handler of the Target Video Easy Publish plugin. The plugin processes a width shortcode attribute and writes its value into rendered HTML output without applying sanitization or escaping routines such as sanitize_text_field() or esc_attr(). Because the injected payload is persisted with the post content, the malicious script executes each time a visitor loads the page.

The attack surface is scoped to authenticated users, but WordPress Contributor accounts are commonly self-registerable on content-heavy sites. Exploitation requires no user interaction beyond an administrator or editor previewing or viewing the crafted post. Successful exploitation can lead to session token theft, forced administrative actions through CSRF chaining, and drive-by installation of additional malicious plugins.

Root Cause

The root cause is insufficient input validation and missing output encoding in the shortcode rendering logic located in lib/BridShortcode.php. The width attribute value is concatenated directly into an HTML attribute context, allowing shortcode parameters such as width='" onmouseover="alert(1)' to break out of the intended attribute and inject event handlers or <script> tags.

Attack Vector

An authenticated attacker with Contributor privileges creates or edits a post containing the vulnerable Brid shortcode with a malicious width parameter. When an editor or administrator previews the post for review, the injected script executes in their browser under the site's origin. See the WordPress Plugin Code Snippet for the vulnerable code location and the Wordfence Vulnerability Intelligence Report for additional technical details.

Detection Methods for CVE-2025-5237

Indicators of Compromise

Post or page content containing Brid shortcodes with unusual width attribute values including quote characters, angle brackets, or event handler keywords such as onerror, onload, or onmouseover.
Unexpected <script> tags or inline JavaScript appearing in rendered post HTML that were not authored by trusted users.
New administrative user accounts or plugin installations shortly after a Contributor account submitted content for review.

Detection Strategies

Audit the wp_posts table for shortcode invocations of brid or brid_video containing suspicious width parameter values.
Monitor WordPress activity logs for post revisions authored by Contributor accounts that were subsequently viewed by administrators.
Deploy a Web Application Firewall (WAF) rule to inspect POST bodies submitted to /wp-admin/post.php for shortcode payloads containing script tags or JavaScript event handlers.

Monitoring Recommendations

Enable verbose logging of privileged user sessions and correlate script execution errors in browser telemetry against post-preview activity.
Track outbound requests from administrator browsers to unfamiliar domains that may indicate exfiltration of session cookies.
Alert on creation or modification of WordPress users with the administrator role outside of change-management windows.

How to Mitigate CVE-2025-5237

Immediate Actions Required

Update the Target Video Easy Publish plugin to a version later than 3.8.5 as soon as the vendor publishes a fixed release.
Restrict Contributor and Author account registration on production WordPress sites and review existing low-privilege accounts for legitimacy.
Purge cached page content and inspect existing posts for malicious width shortcode payloads before re-publishing.

Patch Information

Refer to the WordPress Change Set Update and the WordPress Plugin Developer Page for the current release information and changelog. Site administrators should upgrade to the latest available version and verify the patch by confirming that shortcode attributes are HTML-escaped in rendered output.

Workarounds

Temporarily deactivate the Target Video Easy Publish plugin until a patched version is deployed.
Deploy a WAF rule set that blocks shortcode submissions containing HTML control characters in the width attribute.
Enforce a Content Security Policy (CSP) header that disallows inline scripts to reduce the impact of stored XSS payloads.

bash

# Example nginx Content-Security-Policy header to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;