Security Alert Summary
The CC Child Pages plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the child_pages shortcode. Insufficient input sanitization and output escaping on several shortcode attributes can allow authenticated users with contributor-level access or higher to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2025-13608
- Affected plugin / component: CC Child Pages plugin for WordPress
- Affected versions: All versions up to, and including, 2.0.0
- Published: December 15, 2025 at 3:15:48 PM
- Last modified: December 15, 2025 at 6:22:13 PM
- CVSS v3.1: Base score 6.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated user with contributor-level access or higher. CVSS indicates Privileges Required: LOW; User Interaction: NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue triggered via the child_pages shortcode. The plugin’s show_child_pages function does not sufficiently sanitize or escape four user-supplied shortcode attributes: use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt. Because those attributes are not properly handled, an authenticated attacker with contributor-level access or above can inject arbitrary web scripts into a page output by the shortcode. Injected scripts are stored and will execute in the context of any user who visits the affected page.
This description is derived directly from the CVE entry; no additional code paths, endpoints, or exploit details are specified in the advisory.
How This Could Impact Your Website
Consider a multi-user WordPress site where the site owner manages plugins, internal staff (editors) publish content, and outside contributors submit pages or posts. A contributor with malicious intent could use the vulnerable child_pages shortcode attributes to insert a script into a page. When internal staff or external visitors access that page, the script can execute in their browsers. Practical consequences may include the unauthorized disclosure of information accessible in the browser context (such as data displayed on the page or form inputs) and manipulation of content displayed to those users. Because the CVSS impacts are listed as confidentiality and integrity: LOW and availability: NONE, this vulnerability is not described in the advisory as enabling full site takeover or denial of service, but it does raise risks like targeted data collection or content tampering that could aid phishing or social-engineering attempts.
“If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.”
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can submit content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and content for unusual changes or unexpected scripts added to pages.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
