Stored Cross-Site Scripting Vulnerability in IRM Newsroom Plugin for WordPress

CVE-2025-4585

What is CVE-2025-4585?

The IRM Newsroom plugin for WordPress exposes a vulnerability through its 'irmflat' shortcode, allowing authenticated users with contributor-level access and above to inject malicious web scripts. This occurs due to inadequate input sanitization and output escaping for user-supplied attributes. Consequently, whenever a user visits a page that has been compromised, the injected scripts are executed, potentially leading to unauthorized actions or data exposure. It is essential for users of this plugin to apply updates or patch their installations to mitigate this risk.

References