CVE-2025-8720: WordPress Plugin README Parser XSS Flaw

CVE-2025-8720 Overview

CVE-2025-8720 is a Stored Cross-Site Scripting (XSS) vulnerability in the Plugin README Parser plugin for WordPress. The flaw affects all versions up to and including 1.3.15 and stems from insufficient input sanitization and output escaping on the target parameter [CWE-79]. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript that executes when any user views an affected page. The issue was documented in a Wordfence vulnerability analysis and the WordPress plugin repository.

Critical Impact
Authenticated Contributor users can inject persistent JavaScript into WordPress pages, enabling session theft, redirection, and administrative action hijacking against visitors and site admins.

Affected Products

WordPress Plugin README Parser (wp-readme-parser) versions 1.0 through 1.3.15
WordPress sites allowing Contributor-level user registration with the plugin active
Any page rendering output from the plugin's generate-output.php handler

Discovery Timeline

2025-08-15 - CVE-2025-8720 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8720

Vulnerability Analysis

The Plugin README Parser plugin renders WordPress plugin README files as formatted HTML on a site. The output generation routine in includes/generate-output.php accepts a target parameter that controls link behavior. The plugin writes this value into generated HTML without sufficient sanitization or escaping.

An authenticated user with Contributor privileges or higher can supply a crafted target value containing HTML attribute breakout characters and script payloads. The payload is stored with the post or shortcode configuration and executes in the browser of every subsequent visitor. Because the script executes in the context of the WordPress origin, it can read authenticated cookies accessible to JavaScript, submit administrative forms, and pivot via the WordPress REST API.

The scope change in the CVSS vector reflects that injected script executes in a security context different from the vulnerable component, affecting site visitors and administrators rather than just the attacker.

Root Cause

The root cause is missing input validation on the target parameter combined with missing output escaping when the value is interpolated into HTML attributes. WordPress provides helpers such as esc_attr() and wp_kses() for this purpose, but the vulnerable code path does not apply them before emitting the attribute value.

Attack Vector

An attacker first obtains Contributor-level credentials, either through legitimate registration on sites that allow it or through credential compromise. The attacker then creates or edits a post that invokes the plugin's shortcode or output function with a malicious target value. When an editor, administrator, or site visitor renders the affected page, the browser parses the injected markup and executes the attacker-controlled JavaScript.

For technical details on the vulnerable output function, see the WordPress Plugin Output Generator source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-8720

Indicators of Compromise

Post content or post meta containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload= inside wp-readme-parser shortcodes.
Outbound requests from visitor browsers to unexpected domains originating from rendered plugin pages.
New administrator accounts, modified user roles, or unexpected plugin installations following Contributor activity.
Edits to posts by Contributor accounts that include unusual values in the target attribute.

Detection Strategies

Audit the wp_posts table for shortcodes referencing wp-readme-parser with suspicious target values using SQL LIKE searches.
Enforce a Content Security Policy (CSP) that blocks inline scripts and alerts on violations.
Review web server access logs for POST requests to /wp-admin/post.php from Contributor accounts followed by anomalous GETs to the affected pages.

Monitoring Recommendations

Monitor WordPress audit logs for post creation and editing events performed by Contributor-tier accounts.
Alert on privilege escalation events, including role changes and new administrator creation.
Track installed plugin versions across managed WordPress sites and flag any instance of wp-readme-parser at version 1.3.15 or earlier.

How to Mitigate CVE-2025-8720

Immediate Actions Required

Update the Plugin README Parser plugin to a version later than 1.3.15 as soon as a patched release is available on the WordPress plugin repository.
Review and remove any posts containing suspicious wp-readme-parser shortcodes created or edited by Contributor accounts.
Reset credentials for all Contributor and higher accounts if injection activity is suspected.

Patch Information

At the time of writing, consult the WordPress Plugin Developer page for the current patched release. The vulnerable code path is documented at the WordPress Plugin Output Generator source. The fix requires sanitizing the target parameter with esc_attr() or restricting it to an allowlist of values such as _blank, _self, and _parent.

Workarounds

Deactivate and remove the Plugin README Parser plugin until a patched version is deployed.
Restrict user registration and limit Contributor-level accounts to trusted users only.
Deploy a web application firewall (WAF) rule that blocks requests containing HTML attribute breakout characters in shortcode parameters.
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources.

bash

# Disable the vulnerable plugin via WP-CLI until a patched version is installed
wp plugin deactivate wp-readme-parser
wp plugin delete wp-readme-parser