Markup Markdown < 3.20.10 – Contributor+ Stored XSS | CVE 2025-9540 | Plugin Vulnerabilities

Description

The plugin allows links to contain JavaScript which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Proof of Concept

1. Create a new post using Contributor account.
2. Insert malicious payload inside markdown link, e.g.:
   `[xss](javascript:alert(document.cookie))`
3. Publish the post.
4. When another user views the rendered post and clicks the link, the JavaScript executes.

Affects Plugins

markup-markdown

Fixed in 3.20.10

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

minseok Kim

Submitter

minseok Kim

Verified

Yes

WPVDB ID

79e606df-50a0-4639-b2d9-4a77111fd729

Timeline

Publicly Published

2025-09-01 (about 4 months ago)

Added

2025-09-01 (about 4 months ago)

Last Updated

2025-09-01 (about 4 months ago)

Other

Published

Title

Published

2025-04-23

Title

FuseDesk < 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via successredirect Parameter

Published

2023-05-31

Title

WordPress Social Login <= 3.0.4 - Reflected XSS

Published

2025-01-03

Title

Cf7Save Extension <= 1 - Reflected Cross-Site Scripting

Published

2025-04-01

Title

Bulk NoIndex & NoFollow Toolkit < 2.20 - Reflected Cross-Site Scripting

Published

2024-08-16

Title

Team Showcase < 1.22.24 - Authenticated (Contributor+) Stored Cross-Site Scripting