CVE-2025-8394: Productive Style WordPress XSS Vulnerability

CVE-2025-8394 Overview

CVE-2025-8394 is a Stored Cross-Site Scripting (XSS) vulnerability in the Productive Style plugin for WordPress [CWE-79]. The flaw affects all versions up to and including 1.1.23. The vulnerability resides in the display_productive_breadcrumb shortcode, which fails to properly sanitize input and escape output for user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever a user accesses the affected page.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any visitor, enabling session theft, administrative action hijacking, and malicious redirection.

Affected Products

Productive Style plugin for WordPress, versions up to and including 1.1.23
WordPress sites using the display_productive_breadcrumb shortcode
Any WordPress installation granting contributor-level access to untrusted users

Discovery Timeline

2025-09-17 - CVE-2025-8394 published to the National Vulnerability Database (NVD)
2026-09-26 - Last updated in the NVD database

Technical Details for CVE-2025-8394

Vulnerability Analysis

The Productive Style plugin exposes a shortcode named display_productive_breadcrumb that renders breadcrumb navigation. This shortcode accepts user-supplied attributes that are rendered back into the page HTML. The plugin does not apply sufficient input sanitization on these attributes. It also fails to escape output when the shortcode output is written to the page.

An authenticated user with contributor privileges can embed the shortcode in draft content and supply malicious attribute values. When an editor, administrator, or site visitor views the content, the injected payload executes in their browser context. Because the payload persists in the post data store, the issue qualifies as Stored XSS rather than reflected injection.

The attack scope is marked as changed because scripts execute under the trust boundary of the WordPress site, affecting users other than the attacker. The impact targets confidentiality and integrity of browser sessions.

Root Cause

The root cause is missing input validation and missing output escaping on shortcode attributes in the breadcrumb module. The plugin concatenates attribute values into HTML without applying functions such as esc_attr() or wp_kses(). The vulnerable code path lives in the breadcrumb module shipped at includes/common/module/breadcrumb.php.

Attack Vector

Attack delivery requires authenticated access at the contributor role or higher. The attacker inserts the display_productive_breadcrumb shortcode into a post or page draft with crafted attribute values containing JavaScript. On publication or preview, the server renders the shortcode and emits unescaped markup. The payload then runs in the browser of every subsequent viewer, including privileged administrators.

Technical details on the vulnerable rendering logic are available in the WordPress Plugin Breadcrumb Module source and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8394

Indicators of Compromise

Post or page content containing [display_productive_breadcrumb ...] shortcodes with suspicious attribute values such as <script>, javascript:, or event handlers
Database entries in wp_posts.post_content referencing the shortcode with encoded payloads like <script>
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts
New administrative accounts created without a corresponding login event in server access logs

Detection Strategies

Audit all posts, pages, and reusable blocks for use of the display_productive_breadcrumb shortcode and inspect each attribute value
Review the wp_posts table for shortcode attributes containing HTML tag characters, encoded brackets, or on* event handlers
Monitor web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php originating from contributor-level accounts

Monitoring Recommendations

Enable WordPress audit logging for content creation and shortcode usage by non-administrator roles
Deploy a Content Security Policy (CSP) that blocks inline scripts and reports violations to a monitoring endpoint
Track installed plugin versions against the Productive Style Plugin Repository advisory feed

How to Mitigate CVE-2025-8394

Immediate Actions Required

Update the Productive Style plugin to a release later than 1.1.23 as soon as the vendor publishes a patched version
Audit existing posts and pages for the display_productive_breadcrumb shortcode and remove any suspicious attribute values
Reduce the number of contributor-level accounts and reset credentials for any accounts suspected of misuse
Rotate administrator session cookies and WordPress authentication keys defined in wp-config.php

Patch Information

Review the WordPress Changeset Log and the Productive Style Plugin Repository for the latest release containing input sanitization and output escaping fixes for the breadcrumb shortcode.

Workarounds

Deactivate the Productive Style plugin until a patched version is installed if the breadcrumb shortcode is not business-critical
Restrict contributor and author role assignments to vetted users only, and require editorial review before publishing contributor content
Deploy a web application firewall (WAF) rule that inspects post content for shortcode attributes containing script tags or event handler strings
Enforce a strict Content Security Policy to block inline JavaScript execution across the WordPress front end

bash

# Configuration example: disable the plugin via WP-CLI pending vendor patch
wp plugin deactivate productive-style
wp plugin status productive-style