EUVD-2025-210873
GHSA-4pc2-5jpc-www8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor (low privilege) suffices per description; stored XSS causes scope change in victim browser with limited per-payload confidentiality and integrity impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this.
AnalysisAI
Stored Cross-Site Scripting in the Content Mask WordPress plugin before 1.8.5.6 allows any user holding at least a Contributor-level WordPress account to inject persistent malicious scripts into post content, which then execute in the browsers of all users - including administrators - who view or preview the affected page. Notably, the plugin's own built-in role-restriction feature fails to block the attack, widening the exploitation surface beyond what site operators may expect. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC 'exploitation: none' indicate no observed mass exploitation at time of analysis.
Technical ContextAI
Content Mask is a WordPress plugin that conditionally restricts or masks post content based on visitor role. Affected versions (at least 1.7.1 through 1.8.5.5) fail to properly sanitize and escape HTML and JavaScript submitted within post content before rendering it in plugin-generated page output, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). The Contributor role in WordPress can create posts but cannot publish them without review - however, the flaw triggers on both view and preview, meaning even unpublished drafts can serve as attack vectors. The plugin's internal role-access controls are bypassed entirely, making the sanitization failure the sole defense boundary. The CPE identifier cpe:2.3:a:unknown:content_mask records 'unknown' as the vendor, reflecting an unresolved attribution in NVD rather than an unknown product.
RemediationAI
Upgrade the Content Mask WordPress plugin to version 1.8.5.6 or later, which introduces proper output sanitization and escaping of post content; this is a vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/bb49823c-16f1-4cce-a212-ae2aa7ea5730/. If immediate upgrade is not possible, restrict the Contributor role to only fully trusted users - noting that the plugin's native role-restriction feature does NOT mitigate this flaw and cannot substitute for patching. Temporarily disabling the Content Mask plugin eliminates the attack surface until the patch can be applied. Review existing Contributor accounts for unauthorized additions before patching, as a malicious payload may already be staged in draft content.
More in Content Mask
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today