Executive summary

A stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin “List Subpages” (versions ≤ 1.0.6) has been assigned CVE-2025-8290. An authenticated user with Contributor-level privileges can insert malicious markup into a title parameter that is stored and later rendered unsafely. When a privileged user (administrator/editor) views the affected page, the payload executes in that user’s browser context, potentially leading to session theft, privilege escalation, or persistent site compromise.

This advisory is written by a Hong Kong-based security practitioner with practical guidance for detection, temporary mitigation, and long-term hardening. If your site uses List Subpages, act quickly to limit exposure.

Important: stored XSS payloads are persistent. Even if Contributors cannot publish directly, saved values may be rendered in admin previews or other contexts and remain dangerous until removed or safely escaped.

What is this vulnerability?

• Vulnerability type: Stored Cross-Site Scripting (XSS).
• Affected software: List Subpages plugin for WordPress.
• Vulnerable versions: ≤ 1.0.6.
• CVE: CVE-2025-8290.
• Required privilege: Contributor (authenticated).
• Impact: Malicious title values are stored and later echoed without proper escaping. When an admin/editor loads the page, injected JS runs in their browser session.

Why this matters: stored XSS persists in the database and can execute each time the affected content is rendered. Consequences include account takeover, weaponised admin actions, file modifications, and site-wide persistent abuse.

How an attacker might exploit this

1. Register a low-privilege account (if registration is enabled) or use an existing Contributor account.
2. Submit a crafted title payload through the plugin’s form or API endpoint.
3. The plugin stores the payload without sufficient sanitization/escaping.
4. A privileged user later views a page rendering that title, causing the payload to execute in their browser.
5. The attacker then uses the privileged context to steal sessions, create admin users, or perform other malicious actions.

Common post-exploitation activities: theft of authentication cookies/CSRF tokens, unauthorized admin account creation, installation of backdoors, SEO spam, defacement, and lateral movement to hosting resources.

Technical details (what to assume)

• Vulnerable parameter: title. The plugin stores and later prints this value without proper escaping.
• Root cause: insufficient output encoding at render time — raw echo/print instead of escaping functions such as esc_html(), esc_attr(), or controlled wp_kses().
• Exploit prerequisites: authenticated user (Contributor). Many sites allow registrations, lowering the barrier to exploit.
• No official patch may be available at the time of reading; plan for temporary mitigations until a vendor fix is released or the plugin is replaced.

Note: This advisory will not publish exploit payloads. The objective is to help defenders detect and mitigate without providing attackers with a ready-made template.

Immediate risk assessment — what this means for your site

If your site runs List Subpages (≤ 1.0.6) and allows Contributors or similar roles:

• Risk: Medium (baseline CVSS ≈ 6.5), variable depending on user registration settings and admin activity.
• Urgency: High for sites that allow public registration, actively use the plugin output in admin views, or have multiple admins who preview pages frequently.
• If public registration is disabled and no Contributor accounts exist, risk is reduced but not eliminated (existing accounts could be compromised externally).

Detection — how to check if your site has been targeted

Perform these checks immediately. They are practical and conservative; always make backups before making changes.

1. Search the database for suspicious strings in post titles, post meta, or plugin tables. Look for , onerror=, javascript:, or encoded variants like <script.
2. WP-CLI safe read-only queries (examples):

   wp db query "SELECT ID, post_title, post_type FROM wp_posts WHERE post_title LIKE '%

   wp db query "SELECT meta_id, post_id, meta_key, meta_value FROM wp_postmeta WHERE meta_value LIKE '%

3. If no WP-CLI, use mysqldump + grep or search database exports for suspicious tokens.
4. Inspect recent posts, drafts, previews from low-privilege accounts.
5. Review server and application logs for admin-side GET/POSTs referencing plugin pages or title parameters.
6. Check for new admin users, changed passwords, modified files, unexpected scheduled tasks, or unfamiliar PHP files in uploads or plugin/theme directories.
7. Run malware scans with your existing toolset and search for webshell indicators and unusual file changes.