CVE-2025-5564

Vulnerability

Overview The GC Social Wall plugin for WordPress (versions up to 1.15) contains a stored cross-site scripting (XSS) vulnerability in its gc_social_wall shortcode. The plugin fails to properly sanitize user-supplied attributes and escape output when rendering the shortcode, allowing malicious input to be stored and executed later [1].

Exploitation

An attacker must have at least Contributor-level access to the WordPress site. They can inject arbitrary JavaScript or HTML into the shortcode attributes, which will be stored in the database. When any user (including administrators) visits a page containing the injected shortcode, the script executes in their browser. No additional privileges or network position are required beyond the ability to edit posts/pages.

Impact

Successful exploitation leads to full client-side compromise. The attacker can steal session cookies, perform actions on behalf of the victim, deface the site, or redirect users to malicious domains. Since the XSS is stored, it affects all visitors to the affected page.

Mitigation

The vendor has not released a patched version as of the publication date. Users should disable the plugin or apply a web application firewall rule to block malicious shortcode attributes. The plugin may be abandoned, so migrating to an alternative is recommended.