CVE-2025-7652 Overview
CVE-2025-7652 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Plugin Stats plugin for WordPress. The flaw affects all versions up to and including 2.0.1. The plugin's eps shortcode fails to properly sanitize user-supplied attributes and escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. The issue is tracked as CWE-79.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced actions, and site defacement.
Affected Products
- WordPress Easy Plugin Stats plugin, all versions through 2.0.1
- WordPress sites permitting contributor-level or higher user registration
- Any site rendering pages that embed the eps shortcode
Discovery Timeline
- 2025-10-11 - CVE-2025-7652 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7652
Vulnerability Analysis
The vulnerability resides in the handler for the plugin's eps shortcode. WordPress shortcodes accept attribute key-value pairs supplied by content authors. The Easy Plugin Stats plugin passes these attribute values into rendered HTML without applying WordPress sanitization functions such as esc_attr() or esc_html(). An attacker with contributor privileges can embed the shortcode in a post with malicious attribute values containing HTML or JavaScript. When any user renders the post, the browser parses and executes the injected script in the site's origin.
Stored XSS in an authenticated WordPress context is particularly useful for attackers because posts drafted by contributors are commonly reviewed by editors and administrators. Script execution in an administrator's browser can be pivoted into full site compromise through nonce-authenticated administrative actions.
Root Cause
The root cause is insufficient input sanitization and missing output escaping on shortcode attributes. The plugin trusts author-supplied values and reflects them directly into the DOM. Neither an allowlist of permitted characters nor a contextual escaping wrapper is applied before rendering.
Attack Vector
Exploitation requires an authenticated session with the WordPress contributor role or higher. The attacker submits a post or page containing the eps shortcode with a crafted attribute payload. When the post is previewed, reviewed, or published and later viewed, the payload executes. No user interaction beyond navigating to the page is required for the script to run.
The vulnerability manifests in the plugin's shortcode handler, which concatenates attribute values into HTML output without escaping. Refer to the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-7652
Indicators of Compromise
- Posts or pages containing eps shortcode with attribute values embedding <script>, onerror, onload, or javascript: sequences
- Unexpected outbound requests from administrator browser sessions to attacker-controlled domains
- New administrator or editor accounts created without a corresponding admin action in the audit log
- Modifications to WordPress options such as siteurl, home, or active theme originating from unusual sessions
Detection Strategies
- Query the wp_posts table for post_content values containing [eps combined with <, >, or javascript: substrings
- Review contributor and author accounts for recent post submissions and pending reviews
- Inspect page HTML output for script tags rendered inside attribute contexts under the plugin's shortcode
Monitoring Recommendations
- Enable WordPress audit logging for user role changes, post publication, and options updates
- Deploy a Content Security Policy (CSP) that blocks inline script execution to surface injection attempts
- Monitor web server logs for POST requests to /wp-admin/post.php from contributor accounts that include shortcode attribute payloads
How to Mitigate CVE-2025-7652
Immediate Actions Required
- Update Easy Plugin Stats to a version later than 2.0.1 once the vendor publishes a fix, or deactivate the plugin
- Audit all posts and pages containing the eps shortcode and remove suspicious attribute values
- Review and restrict the contributor role to trusted users only
- Force a password reset for any account that has published content containing the eps shortcode
Patch Information
At the time of NVD publication, no fixed version is identified in the advisory data. Consult the Easy Plugin Stats plugin page for the latest release and changelog. Apply the patched version as soon as it becomes available.
Workarounds
- Deactivate and remove the Easy Plugin Stats plugin until a patched release is available
- Restrict user registration and remove contributor-level access from untrusted accounts
- Implement a strict Content Security Policy prohibiting inline scripts and unknown script sources
- Deploy a Web Application Firewall rule that inspects shortcode attributes for HTML tags and JavaScript URI schemes
# Disable the plugin via WP-CLI until a fix is released
wp plugin deactivate easy-plugin-stats
wp plugin delete easy-plugin-stats
# Identify posts containing the vulnerable shortcode for review
wp db query "SELECT ID, post_title, post_author, post_status FROM wp_posts WHERE post_content LIKE '%[eps%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
