CVE-2025-7369 Overview
CVE-2025-7369 affects the WP Shortcodes Plugin — Shortcodes Ultimate for WordPress in all versions up to and including 7.4.2. The vulnerability stems from missing or incorrect nonce validation on the plugin's preview function. Unauthenticated attackers can execute arbitrary shortcodes through a forged request when a site administrator is tricked into clicking a crafted link. When chained with CVE-2025-7354, this issue escalates to Reflected Cross-Site Scripting (XSS). The flaw is categorized as Cross-Site Request Forgery (CSRF) under [CWE-352].
Critical Impact
Attackers can execute arbitrary shortcodes in an administrator context by chaining a forged request with social engineering, enabling Reflected XSS when combined with CVE-2025-7354.
Affected Products
- WP Shortcodes Plugin — Shortcodes Ultimate for WordPress
- All versions up to and including 7.4.2
- WordPress sites with the plugin's preview function exposed
Discovery Timeline
- 2025-07-21 - CVE-2025-7369 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7369
Vulnerability Analysis
The Shortcodes Ultimate plugin exposes a preview generator function that renders shortcodes on demand. The endpoint does not enforce a valid WordPress nonce, which normally binds a request to an authenticated session. Without this check, any HTTP request that reaches the endpoint with an authenticated administrator's session cookie is honored as legitimate. An attacker exploits this by hosting a page or link that triggers the request when the administrator visits it. The plugin then processes attacker-supplied shortcode input as if the administrator initiated the action. In isolation, the issue permits arbitrary shortcode execution in an admin context. When combined with CVE-2025-7354, the rendered output reflects attacker-controlled markup into the response, resulting in Reflected XSS in the administrator's browser session.
Root Cause
The root cause is missing or incorrect nonce validation on the preview function within the plugin's generator component. Referenced code in inc/core/generator.php handles shortcode rendering without invoking wp_verify_nonce() or check_admin_referer() prior to processing input. This omission violates WordPress's standard CSRF mitigation pattern for privileged actions.
Attack Vector
Exploitation requires user interaction from an authenticated site administrator. The attacker crafts a malicious link or embeds a request in a third-party page. When the administrator clicks the link or loads the page, the browser transmits the forged request along with valid session cookies. The plugin executes the attacker-supplied shortcode payload. Chaining with CVE-2025-7354 causes the preview response to reflect unsanitized attacker content, executing JavaScript in the administrator's browser under the site's origin.
No verified public exploit code has been published. Technical details are available in the CleanTalk CVE-2025-7369 Analysis and the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-7369
Indicators of Compromise
- HTTP requests to the plugin's preview endpoint originating from external Referer headers rather than the WordPress admin dashboard.
- Unexpected shortcode rendering activity in web server logs tied to administrator session cookies.
- Reflected script payloads in preview responses when the plugin is chained with CVE-2025-7354.
Detection Strategies
- Inspect access logs for requests to generator.php or preview AJAX actions lacking a valid _wpnonce parameter.
- Correlate administrator authentication events with subsequent shortcode preview requests from off-site referrers.
- Deploy Web Application Firewall (WAF) rules that flag preview requests without the expected nonce token.
Monitoring Recommendations
- Alert on administrator sessions triggering shortcode preview actions immediately after visiting external links.
- Track outbound requests from admin browsers to unfamiliar domains that may host CSRF payloads.
- Review WordPress audit logs for unusual shortcode content changes committed by administrator accounts.
How to Mitigate CVE-2025-7369
Immediate Actions Required
- Update the Shortcodes Ultimate plugin to a version later than 7.4.2 that includes the fix referenced in WordPress Changeset #3328729.
- Instruct administrators to log out of WordPress before browsing external sites or clicking untrusted links.
- Audit the site for unauthorized shortcode changes or injected content introduced through the preview function.
Patch Information
The vendor addressed the vulnerability by adding nonce validation to the preview function. Refer to WordPress Changeset #3328729 and the vulnerable code at Shortcodes Ultimate generator.php. Upgrade to the patched release published on WordPress.org.
Workarounds
- Disable the Shortcodes Ultimate plugin until the patched version is applied if updating is not immediately possible.
- Restrict access to /wp-admin/ through IP allowlisting to reduce exposure of authenticated administrator sessions.
- Deploy a WAF rule to reject requests to the plugin's preview endpoint that lack a valid _wpnonce parameter.
# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate shortcodes-ultimate
wp plugin update shortcodes-ultimate
wp plugin activate shortcodes-ultimate
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
