CVE-2025-8391: Magic Edge WordPress Plugin XSS Vulnerability

CVE-2025-8391 Overview

CVE-2025-8391 is a Stored Cross-Site Scripting (XSS) vulnerability in the Magic Edge – Lite plugin for WordPress. The flaw affects all versions up to and including 1.1.6. It stems from insufficient input sanitization and output escaping on the height parameter. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages. The injected scripts execute whenever a user accesses the affected page. The vulnerability is categorized under [CWE-79].

Critical Impact
Authenticated Contributor-level users can inject persistent JavaScript that executes in the browsers of visitors and administrators, enabling session theft, forced actions, and account takeover paths.

Affected Products

Magic Edge – Lite plugin for WordPress, versions up to and including 1.1.6
WordPress sites with the magic-edge-lite-image-background-remover plugin installed and activated
Any WordPress environment granting Contributor-level or higher access to untrusted users

Discovery Timeline

2025-08-02 - CVE-2025-8391 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8391

Vulnerability Analysis

The vulnerability resides in the plugin's handling of the height parameter processed by MagicEdgeFrontend.php. The plugin accepts user-supplied values for this parameter without applying sufficient sanitization. It also fails to properly escape the value when it is rendered back into page output.

An authenticated attacker with at least Contributor privileges can embed a malicious payload through the height parameter. The payload is persisted in the WordPress database and reintroduced into page markup on each render. When a visitor or administrator loads the affected page, the browser executes the injected script in the context of the site origin.

The scope change in this vulnerability means the attacker-controlled script executes in a security context different from the vulnerable component itself. Typical outcomes include session cookie theft, forced administrative actions through same-origin requests, redirection to attacker-controlled infrastructure, and delivery of secondary malware.

Root Cause

The root cause is a combination of missing input validation and missing output escaping. The plugin does not restrict the height parameter to a numeric type or an allow-listed set of CSS unit values. It also does not pass the value through WordPress escaping helpers such as esc_attr() before writing it into HTML attributes.

Attack Vector

Exploitation requires an authenticated account with Contributor-level access or higher. The attacker crafts content that passes a malicious height value to the vulnerable rendering path. When the resulting page is viewed by any user, including unauthenticated visitors, the stored script executes. See the Wordfence Vulnerability Analysis and the WordPress Plugin File for the vulnerable code path.

Detection Methods for CVE-2025-8391

Indicators of Compromise

Post or page content containing <script>, onerror=, or javascript: sequences embedded in height attribute values rendered by Magic Edge – Lite shortcodes
Unexpected outbound requests from site visitors' browsers to unknown third-party domains referenced in page markup
New or modified posts authored by Contributor-level accounts that include the Magic Edge – Lite shortcode with unusual attribute payloads

Detection Strategies

Review the wp_posts table for Magic Edge – Lite shortcode usage and inspect height attribute values for script content or HTML metacharacters
Monitor web server access logs for POST requests to admin-ajax.php or post.php from Contributor-level users that modify content containing the plugin's shortcode
Deploy a web application firewall rule to flag HTTP responses that render height attributes containing angle brackets, quotes, or JavaScript protocol handlers

Monitoring Recommendations

Enable WordPress audit logging to track content changes made by Contributor-level and Author-level accounts
Alert on repeated administrative session anomalies, such as cookie reuse from unexpected IP addresses, which can indicate successful session theft
Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages that embed Magic Edge – Lite content

How to Mitigate CVE-2025-8391

Immediate Actions Required

Update the Magic Edge – Lite plugin to a version newer than 1.1.6 as soon as a patched release becomes available on the WordPress plugin repository
Audit all Contributor, Author, and Editor accounts and remove or disable any that are no longer required or appear suspicious
Scan existing posts and pages for malicious payloads in Magic Edge – Lite shortcode attributes and sanitize or remove affected content

Patch Information

At the time of publication, a fixed version addressing CVE-2025-8391 is tracked in the Wordfence Vulnerability Analysis. Administrators should consult the WordPress Plugin Developer Info page for the current release and changelog, and apply updates through the WordPress admin dashboard.

Workarounds

Deactivate and uninstall the Magic Edge – Lite plugin until a patched version is applied
Restrict Contributor-level and higher roles to trusted users only, and require strong authentication for all content-authoring accounts
Deploy a strict Content Security Policy that blocks inline script execution and limits script sources to trusted origins
Place the WordPress site behind a web application firewall configured to inspect and block XSS payloads in shortcode attributes

bash

# Configuration example: enforce a restrictive Content Security Policy via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "SAMEORIGIN"