CVE-2025-8290: WordPress List Subpages Plugin XSS Flaw

CVE-2025-8290 Overview

CVE-2025-8290 is a stored Cross-Site Scripting (XSS) vulnerability in the List Subpages plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.6. It stems from insufficient input sanitization and output escaping on the title parameter [CWE-79].

Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who visits an affected page, including administrators. Successful exploitation can lead to session theft, account takeover, and unauthorized content modification.

Critical Impact
Contributor-level accounts can persist JavaScript payloads that execute against every visitor to the affected page, enabling privilege escalation through administrator session hijacking.

Affected Products

WordPress List Subpages plugin versions 1.0.0 through 1.0.6
WordPress sites permitting Contributor-level or higher user registration
Any WordPress installation with the List Subpages plugin active

Discovery Timeline

2025-08-29 - CVE CVE-2025-8290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8290

Vulnerability Analysis

The List Subpages plugin renders content driven by the title parameter without adequately sanitizing input or escaping output. When a Contributor supplies HTML or JavaScript within the title field, the plugin stores the raw value and later echoes it into rendered pages. Browsers execute the payload in the context of the site's origin.

Because the vulnerability is stored rather than reflected, the payload persists in the database and fires automatically on every page view. The changed scope (S:C) in the CVSS vector reflects that scripts executing in a visitor's browser can affect resources beyond the vulnerable component itself, including WordPress admin sessions.

Root Cause

The plugin's shortcode or template logic accepts the title argument and writes it directly to page output. It does not apply WordPress hardening functions such as sanitize_text_field() on input or esc_html() / esc_attr() on output. This omission is the classic pattern behind [CWE-79] stored XSS in WordPress plugins.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher, which is a low barrier on sites permitting open registration or hosting multiple content authors. The attacker submits content containing a malicious title value that includes an HTML tag with an event handler or <script> block.

When an administrator previews or reviews the injected page, the JavaScript executes with their session context. Common post-exploitation goals include creating a new administrator user, exfiltrating nonces, or planting a persistent backdoor via the plugin editor.

No proof-of-concept exploit code has been published. Detailed technical analysis is available in the Wordfence Vulnerability Analysis and the corresponding WordPress Plugin Changeset.

Detection Methods for CVE-2025-8290

Indicators of Compromise

Page or post records containing <script>, onerror=, onload=, or javascript: sequences within stored title fields.
Unexpected administrator account creation or role changes following Contributor content submissions.
Outbound requests from admin browsers to unfamiliar domains after viewing plugin-rendered pages.
Modifications to plugin or theme files initiated from admin sessions that reviewed subpage content.

Detection Strategies

Query the wp_posts and wp_postmeta tables for HTML event handlers or script tags in fields associated with the List Subpages plugin.
Deploy a Web Application Firewall rule to inspect POST requests containing title parameters routed to the plugin's endpoints.
Enable WordPress audit logging to record Contributor-level content submissions and administrator page views.

Monitoring Recommendations

Alert on installations of the List Subpages plugin at versions 1.0.6 or earlier.
Monitor admin session activity for anomalous XHR requests to wp-admin/user-new.php or wp-admin/plugin-editor.php.
Track file integrity for wp-config.php, theme files, and plugin directories to identify post-XSS persistence.

How to Mitigate CVE-2025-8290

Immediate Actions Required

Update the List Subpages plugin to a version newer than 1.0.6 as soon as the vendor publishes a patched release.
Audit all Contributor and Author accounts, disabling any that are inactive or unrecognized.
Review existing pages and posts for injected script content and purge malicious entries.
Rotate administrator credentials and invalidate active sessions if injected payloads are found.

Patch Information

Refer to the List Sub Pages Plugin Details page for the current release status and the WordPress Plugin Changeset for source-level remediation details. Site administrators should apply the fixed version through the WordPress plugin manager once available.

Workarounds

Deactivate and remove the List Subpages plugin until a patched version is available.
Restrict user registration and limit Contributor role assignment to trusted individuals only.
Deploy a Web Application Firewall that blocks XSS payloads in the title request parameter.
Apply a Content Security Policy that disallows inline scripts to reduce the impact of injected payloads.

bash

# Configuration example: disable the plugin via WP-CLI pending a patch
wp plugin deactivate list-sub-pages
wp plugin delete list-sub-pages

# Optional: enforce a restrictive Content Security Policy header
# Add to your web server configuration (nginx example)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'" always;