CVE-2025-6546 Overview
CVE-2025-6546 is a Stored Cross-Site Scripting (XSS) vulnerability in the Drive Folder Embedder plugin for WordPress. The flaw affects all versions up to and including 1.1.0. The plugin fails to sanitize input and escape output on the tablecssclass parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page, including administrators. The vulnerability is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can store malicious JavaScript that executes in administrator browsers, enabling session theft and account takeover.
Affected Products
- Azumbro Drive Folder Embedder plugin for WordPress
- All versions up to and including 1.1.0
- WordPress sites allowing Contributor-level accounts or higher
Discovery Timeline
- 2025-06-26 - CVE-2025-6546 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6546
Vulnerability Analysis
The Drive Folder Embedder plugin exposes shortcode and configuration parameters that render user-supplied values into HTML output. The tablecssclass parameter is intended to accept a CSS class name for styling embedded Google Drive folder tables. The plugin writes this value into page markup without applying WordPress escaping functions such as esc_attr() or esc_html(). An attacker who controls the parameter can break out of the attribute context and inject arbitrary <script> payloads or event handlers.
Exploitation requires an authenticated session at Contributor level or above, which lowers the barrier on multi-author WordPress sites. The payload executes with the privileges of whichever user views the compromised page. When an administrator triggers the script, the attacker can hijack the session, create new administrative accounts, or inject persistent backdoors into site content and themes.
Root Cause
The root cause is insufficient input sanitization and output escaping on the tablecssclass parameter. The plugin treats parameter input as trusted and concatenates it directly into HTML attribute context. WordPress provides dedicated escaping APIs for this scenario, but the affected code paths do not invoke them.
Attack Vector
The attack is network-reachable and requires low-privilege authentication plus user interaction. A contributor crafts a post, page, or shortcode that includes a malicious tablecssclass value containing JavaScript. The payload persists in the WordPress database. When any logged-in user, especially an administrator, renders the page, the script executes in their browser context. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-6546
Indicators of Compromise
- Unexpected <script> tags, onerror, onload, or onmouseover attributes within post or page content stored in the wp_posts table.
- Outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading pages that embed Drive folders.
- Unauthorized creation of new WordPress administrator accounts following contributor activity.
- Modified theme or plugin files with injected JavaScript loaders.
Detection Strategies
- Scan post content and shortcode attributes for the tablecssclass parameter containing angle brackets, quote-breaking characters, or javascript: schemes.
- Review WordPress audit logs for Contributor-level accounts creating or editing content that includes Drive Folder Embedder shortcodes.
- Deploy a web application firewall (WAF) rule that blocks XSS payloads targeting the plugin's shortcode attributes.
Monitoring Recommendations
- Monitor admin-area HTTP responses for script tags originating from untrusted content fields.
- Alert on new administrator role assignments and changes to wp_users or wp_usermeta tables.
- Track plugin version inventory across WordPress deployments to confirm patched builds are installed.
How to Mitigate CVE-2025-6546
Immediate Actions Required
- Update the Drive Folder Embedder plugin to a version later than 1.1.0 once the vendor publishes a fix.
- Audit existing posts and pages that use the plugin's shortcodes for injected JavaScript in the tablecssclass attribute.
- Review Contributor-level and above accounts for legitimacy and rotate credentials where suspicious activity is observed.
- Force session invalidation for administrators who may have viewed compromised pages.
Patch Information
No fixed version is referenced in the NVD entry at publication. Consult the WordPress Plugin Documentation and the Wordfence Vulnerability Report for current patch status. Until a patch is available, deactivate the plugin on production sites.
Workarounds
- Deactivate and remove the Drive Folder Embedder plugin until a patched release is available.
- Restrict Contributor and higher role assignments to trusted users only.
- Deploy a WAF rule that strips or blocks HTML control characters in the tablecssclass shortcode attribute.
- Enforce Content Security Policy (CSP) headers that disallow inline scripts in the WordPress admin area.
# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate drive-folder-embeder
wp plugin delete drive-folder-embeder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
