CVE-2025-58021 Overview
CVE-2025-58021 is a stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin List Child Pages Shortcode by douglaskarr. The flaw affects all versions up to and including 1.3.1. Attackers with contributor-level or higher privileges can inject malicious scripts that persist in the database and execute in the browsers of site visitors and administrators. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in other users' browser sessions, enabling session theft, administrative account takeover, and defacement of WordPress pages using the list-child-pages shortcode.
Affected Products
- WordPress plugin List Child Pages Shortcode by douglaskarr
- All versions from n/a through 1.3.1
- WordPress sites that install and activate the affected plugin
Discovery Timeline
- 2025-09-22 - CVE-2025-58021 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58021
Vulnerability Analysis
The List Child Pages Shortcode plugin renders lists of child pages via a WordPress shortcode. The plugin fails to properly neutralize user-supplied input before including it in generated HTML output. Attacker-controlled data reaches the rendered page without adequate encoding or sanitization.
Because the payload is stored server-side, every subsequent visitor who loads a page containing the vulnerable shortcode executes the injected script. The attack requires authentication with low privileges and a user interaction to trigger execution. The scope change in the impact metric indicates the injected script executes in the browser context of other users, breaking the trust boundary between the attacker's account and higher-privileged administrators.
Root Cause
The root cause is missing output encoding in the shortcode rendering path. Input handled by the plugin is written into the DOM without being passed through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows arbitrary HTML and JavaScript to be persisted and later served to end users.
Attack Vector
Exploitation requires network access to the target WordPress site and an authenticated account with permission to submit content processed by the plugin. The attacker stores a crafted payload containing JavaScript. When an administrator or other user views a page that renders the child pages list, the browser executes the payload. Refer to the Patchstack XSS Vulnerability Report for additional technical detail.
No public proof-of-concept exploit code has been released for this vulnerability.
Detection Methods for CVE-2025-58021
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes stored in WordPress wp_posts content associated with the list-child-pages shortcode
- New administrator accounts or role changes shortly after a contributor-level user submitted or edited content
- Outbound requests from administrator browsers to unknown domains after viewing pages that render child page lists
- Modified plugin or theme files following an administrator session that loaded a shortcode-rendered page
Detection Strategies
- Query the WordPress database for shortcode instances containing HTML tags or JavaScript event handlers in their attributes
- Deploy web application firewall rules that flag script payloads in POST requests to post.php and admin-ajax.php
- Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts
Monitoring Recommendations
- Monitor WordPress audit logs for content edits made by contributor and author roles
- Alert on privilege escalation events, particularly promotions to administrator role
- Track browser telemetry from administrator workstations for anomalous JavaScript execution and outbound connections
How to Mitigate CVE-2025-58021
Immediate Actions Required
- Deactivate the List Child Pages Shortcode plugin until a patched release is verified and installed
- Audit all pages and posts using the list-child-pages shortcode for embedded scripts or suspicious HTML
- Review and rotate credentials for any administrator accounts that may have loaded compromised pages
- Restrict contributor and author registration if not required for site operations
Patch Information
At the time of publication, no fixed version has been listed in the NVD entry. Site operators should monitor the Patchstack advisory and the plugin's WordPress.org page for a version above 1.3.1 that addresses the missing output encoding.
Workarounds
- Remove the plugin entirely and replace its functionality with a maintained alternative that escapes shortcode output
- Apply a virtual patch through a WordPress-aware WAF that strips HTML tags from shortcode attributes
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
- Limit shortcode usage to trusted editors by restricting the unfiltered_html capability
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
