CVE-2025-10180 in Markdown Shortcode Plugin
Summary
by MITRE • 09/26/2025
The Markdown Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'markdown' shortcode in all versions up to, and including, 0.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2025
The vulnerability identified as CVE-2025-10180 affects the Markdown Shortcode plugin for WordPress, specifically targeting versions up to and including 0.2.1. This represents a critical security flaw that enables stored cross-site scripting attacks through the plugin's 'markdown' shortcode functionality. The issue stems from inadequate input sanitization and output escaping mechanisms that fail to properly validate or sanitize user-supplied attributes before processing them within the shortcode implementation. Attackers with contributor-level privileges or higher can exploit this weakness to inject malicious scripts that persist in the system and execute whenever affected pages are accessed by other users.
The technical exploitation of this vulnerability occurs through the manipulation of shortcode attributes that are processed by the plugin without proper security measures. When an authenticated attacker with contributor-level access or above creates or modifies content using the markdown shortcode, they can include malicious script code within the shortcode parameters. These scripts are then stored within the WordPress database and executed in the context of other users' browsers when they view pages containing the compromised shortcode. This creates a persistent threat vector that can affect any user who accesses content containing the injected scripts, regardless of their privilege level or authentication status.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities including session hijacking, data exfiltration, and redirection to malicious sites. The stored nature of the XSS attack means that the malicious code remains active until manually removed from the system, potentially allowing attackers to maintain persistent access to compromised WordPress installations. This vulnerability particularly affects WordPress environments where multiple users have contributor-level access or higher, making it a significant concern for sites with collaborative content management systems or user-generated content platforms.
Security mitigations for this vulnerability should focus on immediate remediation through plugin updates to versions that address the input sanitization and output escaping deficiencies. Organizations should implement strict access controls and privilege management to limit contributor-level access to trusted users only, while also considering the deployment of web application firewalls that can detect and block malicious shortcode parameters. The vulnerability aligns with CWE-79, which describes cross-site scripting flaws resulting from insufficient input validation and output escaping, and maps to ATT&CK technique T1566.001 for initial access through malicious content. Regular security auditing of WordPress plugins and maintaining up-to-date security patches remain critical defensive measures against similar vulnerabilities in the WordPress ecosystem.