CVE-2025-46445

Vulnerability

The External Markdown plugin for WordPress (slug: external-markdown) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation. Versions through and including 0.0.1 are affected. The vulnerability exists in the plugin's handling of markdown content, where arbitrary HTML or JavaScript can be injected and stored, to be executed when a victim views the affected page.

Exploitation

An attacker with the ability to submit or modify content processed by the plugin (e.g., via comments, posts, or other input fields) can inject malicious script payloads. No authentication is required beyond the access needed to provide input; the plugin does not sanitize the markdown input before rendering. The injected script is stored on the server and executed in the context of any user who later views the page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of a viewing user. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attacker's script runs with the privileges of the victim's WordPress user session, potentially enabling actions such as posting content or modifying settings if the victim is an administrator.

Mitigation

As of April 24, 2025, the External Markdown plugin has been closed and removed from the WordPress.org plugin directory due to a security issue [1]. No patched version has been released. Users who have the plugin installed should immediately uninstall it and remove any stored content that may contain malicious payloads. There is no known workaround aside from disabling or deleting the plugin entirely.