CVE-2025-4168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4168", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-01T12:10:06.166Z", "datePublished": "2025-05-03T01:43:06.141Z", "dateUpdated": "2026-04-08T17:14:56.770Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:56.770Z"}, "affected": [{"vendor": "codework", "product": "Subpage List", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Subpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5-1718110147dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/subpage-view/trunk/inc/class-subpage-list-shortcode.php#L25"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-05-02T11:32:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-05T14:40:43.688131Z", "id": "CVE-2025-4168", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T14:58:09.080Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-05T14:40:43.688131Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-05T14:40:44.933Z"}}], "cna": {"title": "Subpage List <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "codework", "product": "Subpage List", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-02T11:32:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5-1718110147dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/subpage-view/trunk/inc/class-subpage-list-shortcode.php#L25"}], "descriptions": [{"lang": "en", "value": "The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:14:56.770Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4168", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:14:56.770Z", "dateReserved": "2025-05-01T12:10:06.166Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-05-03T01:43:06.141Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Subpage List", "vendor": "codework", "versions": [{"lessThanOrEqual": "1.3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Subpage List para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode \"subpages\" del complemento en todas las versiones hasta la 1.3.3 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-4168", "lastModified": "2026-06-17T09:32:41.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-05-05T14:40:43.688131Z", "version": "2.0.3"}}]}, "published": "2025-05-03T03:15:28.350", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/subpage-view/trunk/inc/class-subpage-list-shortcode.php#L25"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aca48ddf-4256-4a55-bff5-1718110147dd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:59:20.185441+00:00", "value": {"mitigation_remediation": ["Update Subpage\u00a0List to a version later than 1.3.3 to eliminate the stored XSS flaw.", "If an upgrade is not immediately possible, restrict the 'subpages' shortcode to trusted users or remove it from pages that do not require it.", "Deploy a web application firewall rule that detects and blocks script tags or other executable content within 'subpages' shortcode attributes until the plugin is updated."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (Contributor\u2011level)"}, "threat_synthesis": {"affected_systems": "WordPress sites that run Subpage\u00a0List version\u00a01.3.3 or earlier are affected. The vulnerability does not extend to other plugins or core WordPress components. Any installation that has not upgraded beyond 1.3.3 remains vulnerable.", "description_and_impact": "The Subpage List plugin for WordPress contains a stored cross\u2011site scripting flaw in versions up to 1.3.3. The flaw resides in the handling of the 'subpages' shortcode, where user\u2011supplied attributes are not properly sanitized or escaped. As a result, an authenticated contributor or higher can inject arbitrary JavaScript into the page content that will execute for any visitor who views the affected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first authenticate with contributor\u2011level credentials or higher. Once authenticated, the attacker can insert malicious attributes into the shortcode, causing a stored XSS that triggers when any user loads the offending page."}}}}, "created": "2026-04-21T21:00:36.013899+00:00", "updated": "2026-04-21T21:00:36.013910+00:00", "vendors": []}