CVE-2025-8777 Overview
CVE-2025-8777 is a stored Cross-Site Scripting (XSS) vulnerability affecting the planetcalc plugin for WordPress through version 2.2. The flaw resides in the handling of the language parameter, which lacks sufficient input sanitization and output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in any visitor's browser when the affected page loads. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers with low privileges can store malicious scripts that execute against site visitors and administrators, enabling session theft, account takeover, and administrative action hijacking.
Affected Products
- WordPress planetcalc plugin, all versions up to and including 2.2
- WordPress sites allowing Contributor-level registration or higher
- Any site rendering content generated through the vulnerable language parameter
Discovery Timeline
- 2025-09-30 - CVE-2025-8777 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8777
Vulnerability Analysis
The planetcalc plugin processes a language parameter without applying WordPress sanitization helpers such as sanitize_text_field() or escaping functions like esc_attr() and esc_html() on output. An authenticated Contributor can submit payload content that is stored by the plugin and later rendered into page markup verbatim. When any user, including administrators and anonymous visitors, loads the page, the browser parses the injected script as legitimate site code.
Stored XSS in a WordPress context typically enables cookie theft, forced actions through the WordPress REST API, and silent creation of attacker-controlled administrator accounts. Because the attack vector is network-based and requires only Contributor privileges, sites with open author registration are at elevated risk. Review the Wordfence Vulnerability Report for additional detail.
Root Cause
The root cause is missing input validation and missing output encoding on the language parameter inside the plugin's rendering logic in planetcalc.php. User-supplied data flows directly into HTML context without passing through WordPress escaping APIs.
Attack Vector
An attacker authenticates to the WordPress site with Contributor privileges, creates or edits a post that invokes the plugin shortcode, and supplies a crafted language parameter containing JavaScript. The payload persists in the database. When any user views the resulting page, the script executes under the site's origin.
No verified public proof-of-concept code is available for CVE-2025-8777. Refer to the WordPress Plugin Source Code for the vulnerable code path.
Detection Methods for CVE-2025-8777
Indicators of Compromise
- Post or page content containing <script>, onerror=, onload=, or javascript: strings within planetcalc shortcode attributes
- Unexpected Contributor or Author accounts creating pages that invoke the planetcalc shortcode
- Outbound requests from visitor browsers to unfamiliar domains after loading pages that use the plugin
Detection Strategies
- Query the wp_posts table for planetcalc shortcodes containing suspicious characters such as <, >, or javascript: inside the language attribute
- Monitor WordPress audit logs for post edits by low-privilege users that introduce the planetcalc shortcode
- Deploy a web application firewall rule to flag HTTP POST requests containing script tags targeted at post.php or the REST API
Monitoring Recommendations
- Alert on creation of new administrator accounts shortly after a Contributor publishes planetcalc-enabled content
- Capture Content Security Policy violation reports to surface inline script execution attempts
- Track plugin file integrity and version metadata to confirm patched installations across the estate
How to Mitigate CVE-2025-8777
Immediate Actions Required
- Deactivate the planetcalc plugin on all WordPress sites until a patched version is confirmed installed
- Audit Contributor, Author, and Editor accounts, removing any that are unknown or inactive
- Review all posts and pages containing the planetcalc shortcode for malicious language parameter content
- Rotate administrator session cookies and credentials if indicators of exploitation are found
Patch Information
At the time of publication, the WordPress Plugin Developer Page should be consulted for the latest release. Upgrade to a version greater than 2.2 once the maintainer publishes a fix that applies proper sanitization and output escaping to the language parameter.
Workarounds
- Restrict Contributor and Author role assignment to trusted users only
- Deploy a Content Security Policy that disallows inline script execution on pages rendering plugin shortcodes
- Use a web application firewall ruleset that blocks script tags and event handlers in parameters submitted to WordPress editor endpoints
- Remove the planetcalc shortcode from existing posts if the plugin is not business-critical
# Configuration example: locate and disable the vulnerable plugin
wp plugin deactivate planetcalc --all
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[planetcalc%language=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
