CVE-2025-7966: Get Youtube Subs WordPress Plugin XSS Flaw

CVE-2025-7966 Overview

CVE-2025-7966 is a Stored Cross-Site Scripting (XSS) vulnerability in the Get Youtube Subs plugin for WordPress. The flaw affects all versions up to and including 3.5. It stems from insufficient input sanitization and output escaping on the channel, layout, and subs_count parameters. Authenticated users with Contributor-level access or above can inject arbitrary JavaScript that executes when other users view the affected pages. The issue is tracked as CWE-79.

Critical Impact
Authenticated contributors can plant persistent JavaScript payloads that run in the browsers of site visitors and administrators, enabling session theft, account takeover, and arbitrary actions on behalf of higher-privileged users.

Affected Products

Get Youtube Subs plugin for WordPress — all versions ≤ 3.5
WordPress sites exposing the plugin's shortcode to Contributor-level accounts
Any WordPress deployment that renders attacker-controlled plugin output to administrators or visitors

Discovery Timeline

2025-07-24 - CVE-2025-7966 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7966

Vulnerability Analysis

The Get Youtube Subs plugin exposes a shortcode that accepts user-supplied parameters including channel, layout, and subs_count. The plugin processes these parameters and reflects them into page output without applying sufficient sanitization on input or escaping on output. Because the shortcode content is persisted inside WordPress posts and pages, injected markup is stored in the database and executed each time the containing page is rendered. The vulnerability is reachable by any authenticated account at Contributor level or above, which lowers the exploitation barrier on sites that accept guest authors or community contributors. Successful injection runs attacker JavaScript in the context of the WordPress origin, giving the payload access to session cookies, the REST API, and the WordPress admin interface when triggered by a privileged user.

Root Cause

The root cause is a classic failure to apply WordPress sanitization and escaping APIs. Input is not filtered through functions such as sanitize_text_field() or wp_kses(), and output is not passed through esc_attr() or esc_html() before being written into HTML. See the plugin source reference for the vulnerable code path.

Attack Vector

An authenticated contributor creates or edits a post containing the plugin's shortcode and supplies a crafted value for channel, layout, or subs_count that breaks out of the intended attribute context and injects HTML or <script> content. After the post is submitted and viewed, the stored payload executes in each visitor's browser. The attack is remote, requires low privileges, and no user interaction beyond visiting the affected page. For additional analysis, consult the Wordfence vulnerability report.

Detection Methods for CVE-2025-7966

Indicators of Compromise

Posts or pages containing the Get Youtube Subs shortcode with <script>, onerror=, onload=, or javascript: tokens in the channel, layout, or subs_count parameters
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating on pages that render the plugin's shortcode
New or modified posts authored by Contributor-level accounts that embed the plugin shortcode shortly before anomalous admin session activity

Detection Strategies

Query the wp_posts table for shortcode usage and inspect parameter values for HTML control characters or event handler attributes
Enable a Web Application Firewall (WAF) ruleset targeting stored XSS patterns in WordPress shortcode parameters
Review WordPress audit logs for post edits by Contributor accounts followed by administrator page views on the same URLs

Monitoring Recommendations

Alert on browser Content Security Policy (CSP) violation reports originating from pages rendered by the plugin
Monitor WordPress user role changes and new administrator accounts, which are a common post-exploitation outcome of admin-session XSS
Track plugin version inventory across WordPress estates and flag any instance still running Get Youtube Subs 3.5 or earlier

How to Mitigate CVE-2025-7966

Immediate Actions Required

Deactivate and remove the Get Youtube Subs plugin until a patched release above version 3.5 is confirmed available and installed
Audit all posts and pages for existing shortcode instances and remove any containing suspicious parameter values
Reduce the number of Contributor-level accounts and review recent account registrations for abuse

Patch Information

At the time of NVD publication, all versions up to and including 3.5 are affected. Monitor the WordPress plugin page for a fixed release and update immediately once one is published. If no patched version is available, uninstall the plugin.

Workarounds

Restrict post creation and editing capabilities so that only trusted Editor or Administrator roles can publish content containing shortcodes
Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in requests to wp-admin/post.php when the Get Youtube Subs shortcode is present
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads

bash

# Configuration example: disable the plugin via WP-CLI as an immediate mitigation
wp plugin deactivate get-youtube-subs
wp plugin delete get-youtube-subs

# Audit stored posts for shortcode usage containing suspicious characters
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%get-youtube-subs%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"