CVE-2025-7653 in EPay Payments Plugin
Summary
by MITRE • 07/19/2025
The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2025
The EPay.bg Payments plugin for WordPress presents a critical stored cross-site scripting vulnerability identified as CVE-2025-7653 affecting all versions through 0.1. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's 'epay' shortcode implementation. The flaw specifically targets user-supplied attributes that are processed without proper validation or sanitization, creating a persistent vector for malicious script injection that can execute in the context of any user who accesses affected pages.
The technical nature of this vulnerability places it squarely within CWE-79 - Improper Neutralization of Input During Web Page Generation, which represents one of the most prevalent and dangerous web application security flaws. Attackers with contributor-level privileges or higher can exploit this weakness by injecting malicious scripts through the plugin's shortcode parameters, which are then stored within the WordPress database. When other users access pages containing these injected scripts, the malicious code executes in their browsers, potentially leading to session hijacking, credential theft, or further exploitation of the compromised user accounts.
The operational impact of this vulnerability extends beyond simple script execution as it enables attackers to establish persistent footholds within the WordPress environment. Since the injection occurs through the shortcode mechanism, attackers can craft malicious payloads that target specific user roles or exploit the vulnerability across multiple pages. The stored nature of the XSS means that the malicious scripts remain active until manually removed by administrators, providing attackers with extended periods of access and potential for data exfiltration. This vulnerability particularly threatens sites that rely on contributor or higher-level user accounts for content management, as these roles typically have the ability to modify posts and pages where shortcodes can be inserted.
Organizations should prioritize immediate mitigation by updating to the latest plugin version where this vulnerability has been addressed, as the flaw affects all versions up to and including 0.1. Administrators should also implement additional defensive measures including input validation for shortcode parameters, output escaping of all user-supplied content, and regular security auditing of plugin installations. The ATT&CK framework categorizes this vulnerability under T1566 - Phishing, as attackers can leverage the XSS to redirect users to malicious sites or steal session cookies. Security teams should monitor for suspicious shortcode usage patterns and consider implementing web application firewalls to detect and block malicious injection attempts. Given the contributor-level privilege requirement, organizations should also review and tighten user access controls to minimize potential attack surface while maintaining operational functionality.