A security flaw has been identified in the List Children plugin for WordPress, impacting all versions up to and including 2.1. This vulnerability, known as Stored Cross-Site Scripting (XSS), could allow malicious code to run on your website, posing a risk to visitors.<\/p>\n
At its core, this issue stems from how the plugin handles information provided by users. Specifically, the ‘list_children’ shortcode doesn’t properly clean up or secure certain details entered by authenticated users. This means someone with the right access (like a contributor) could sneak in harmful web scripts, which would then execute whenever another user visits a page containing that injected code.<\/p>\n
Product:<\/strong> List Children plugin for WordPress<\/p>\n Published Date:<\/strong> May 1, 2025<\/p>\n Severity:<\/strong> Medium<\/p>\n Status:<\/strong> Analyzed<\/p>\n The List Children plugin for WordPress, across all versions up to, and including, 2.1, is vulnerable. If you are using this plugin and have not updated it recently, your website may be at risk.<\/p>\n The vulnerability, identified as CVE-2025-4099, has been analyzed. This means security experts have reviewed the flaw and understand its nature and potential impact. Users are advised to stay informed about any official patches or updates released by the plugin developer.<\/p>\n This vulnerability is rated as Medium severity, with a CVSS score of 6.4. A medium rating indicates that while the vulnerability is significant, it might require specific conditions or user interaction to be exploited. In this case, an attacker needs at least contributor-level access to your WordPress site to inject the malicious scripts. However, once injected, these scripts can affect any user who views the compromised page, potentially leading to data theft, session hijacking, or defacement of your website.<\/p>\n Protecting your WordPress site from Stored XSS vulnerabilities like CVE-2025-4099 is crucial. Here are some steps you can take:<\/p>\n https:\/\/plugins.trac.wordpress.org\/browser\/list-children\/trunk\/list_children.php#L26<\/p>\n https:\/\/plugins.trac.wordpress.org\/changeset\/3284430\/<\/p>\n https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/538b4d4b-f8c6-44db-89d2-d345bfbfecb2?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":" A security flaw has been identified in the List Children plugin for WordPress, impacting all versions up to and including 2.1. This vulnerability, known as Stored Cross-Site Scripting (XSS), could allow malicious code to run on your website, posing a risk to visitors. At its core, this issue stems from how the plugin handles information […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1149,715,695,726,692],"class_list":["post-3711","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-list-children","tag-plugin-vulnerability","tag-web-security","tag-wordpress","tag-xss"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n