CVE-2025-8906 Overview
CVE-2025-8906 is a Stored Cross-Site Scripting (XSS) vulnerability in the Widgets for TikTok Feed plugin for WordPress. The flaw exists in the plugin's trustindex-feed shortcode and affects all versions up to and including 1.7.3. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts. Injected payloads execute in the browser of any user who views an affected page. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and arbitrary redirection of site visitors.
Affected Products
- Widgets for TikTok Feed plugin for WordPress — all versions up to and including 1.7.3
- WordPress sites allowing contributor-level or higher registrations
- Sites using the trustindex-feed shortcode in published content
Discovery Timeline
- 2025-09-26 - CVE-2025-8906 published to the National Vulnerability Database
- 2026-10-11 - Last updated in NVD database
Technical Details for CVE-2025-8906
Vulnerability Analysis
The vulnerability resides in the plugin's trustindex-feed shortcode handler. The handler accepts user-supplied attributes and renders them into HTML output without applying sufficient input sanitization or output escaping. When a contributor or higher-privileged user embeds the shortcode with crafted attribute values, the resulting markup contains attacker-controlled script content.
Because the payload is stored with the post or page, every subsequent visitor executes the injected JavaScript in the context of the WordPress site. The attack crosses privilege boundaries: a low-privilege contributor can target administrators who later preview or publish the content. The CVSS vector reflects a scope change, since code executes in the browser of users outside the attacker's authorization boundary.
Root Cause
The root cause is the absence of proper escaping functions such as esc_attr(), esc_html(), or wp_kses() on shortcode attributes before rendering them into the DOM. WordPress provides these APIs specifically to neutralize HTML and JavaScript metacharacters, and the vulnerable plugin fails to call them on the attribute paths used by trustindex-feed.
Attack Vector
An authenticated attacker with contributor privileges authors a post or page containing the trustindex-feed shortcode with malicious attribute values. After the post is viewed, previewed, or published, the injected script executes in the browser of any visitor, including administrators. Payloads can exfiltrate session cookies, perform CSRF-based privilege escalation, modify site content, or redirect users to attacker-controlled infrastructure. Review the Wordfence Vulnerability Report and the WordPress Plugin Change Log for additional technical context.
Detection Methods for CVE-2025-8906
Indicators of Compromise
- Posts or pages containing trustindex-feed shortcodes with attribute values that include <script>, onerror=, onload=, javascript:, or encoded variants.
- Unexpected outbound requests from visitor browsers to unfamiliar domains originating from pages that render the shortcode.
- New or modified administrator accounts created shortly after a contributor published content containing the shortcode.
Detection Strategies
- Query the wp_posts table for post_content entries matching the trustindex-feed shortcode and inspect attribute payloads for HTML or JavaScript metacharacters.
- Review web server access logs for anomalous requests from authenticated contributor sessions submitting shortcode content.
- Deploy a web application firewall rule to flag shortcode attributes containing script tags or event handler patterns.
Monitoring Recommendations
- Audit contributor and author account activity for unusual post creation or editing patterns.
- Monitor browser Content Security Policy (CSP) violation reports for inline script execution on pages using the plugin.
- Alert on changes to administrator role assignments or newly registered privileged accounts following content publication events.
How to Mitigate CVE-2025-8906
Immediate Actions Required
- Update the Widgets for TikTok Feed plugin to a version later than 1.7.3 as soon as the vendor publishes a patched release.
- Audit existing posts and pages for trustindex-feed shortcode usage and remove any attribute values containing executable content.
- Review and restrict contributor-level account creation, enforcing manual approval for new user registrations.
Patch Information
Consult the WordPress Plugin Change Log for the most recent plugin changeset and apply the latest available version. If no patch is yet available for your installed version, deactivate the plugin until a fixed release is published.
Workarounds
- Deactivate the Widgets for TikTok Feed plugin until a patched version is installed.
- Remove the contributor role from untrusted users or disable the role entirely using a role management plugin.
- Deploy a web application firewall ruleset that strips <script> tags and JavaScript event handlers from shortcode attribute values submitted through the WordPress editor.
# Configuration example: disable the plugin via WP-CLI pending a patched release
wp plugin deactivate widgets-for-tiktok-video-feed
# Identify posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[trustindex-feed%' AND post_status IN ('publish','draft','pending');"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
