CVE-2020-37225: Powie's WHOIS Domain Check XSS Flaw

CVE-2020-37225 Overview

CVE-2020-37225 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Powie's WHOIS Domain Check WordPress plugin version 0.9.31. The flaw resides in the pwhois_settings.php configuration page, where textarea and input elements fail to sanitize user-supplied content. An authenticated attacker with access to the plugin settings can inject arbitrary JavaScript that executes in the administrator's browser context. Successful exploitation enables session theft, privilege escalation, and arbitrary actions performed under the admin account on the WordPress site.

Critical Impact

Authenticated attackers can store malicious JavaScript in plugin settings, leading to administrator account compromise and full WordPress site takeover.

Affected Products

• Powie's WHOIS Domain Check WordPress plugin version 0.9.31
• WordPress installations with the vulnerable plugin enabled
• Administrative interfaces exposing pwhois_settings.php

Discovery Timeline

• 2026-05-13 - CVE-2020-37225 published to the National Vulnerability Database (NVD)
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2020-37225

Vulnerability Analysis

The vulnerability is a persistent (stored) cross-site scripting issue affecting the plugin's settings interface. Powie's WHOIS Domain Check accepts user input through textarea and input fields in pwhois_settings.php without applying output encoding or input validation. The supplied content is later rendered within the WordPress admin dashboard, allowing browser execution of injected scripts.

Because the payload is stored in the WordPress database, it triggers each time an administrator loads the configuration page. The attacker payload runs with the privileges of the viewing user, typically a site administrator. This enables theft of authentication cookies, manipulation of WordPress REST API actions, and creation of attacker-controlled administrator accounts.

Root Cause

The root cause is missing input sanitization and output encoding in the plugin settings handler. The plugin does not apply WordPress sanitization helpers such as sanitize_text_field() on save, nor esc_attr() or esc_html() on render. Any HTML or JavaScript submitted is persisted verbatim.

Attack Vector

Exploitation requires authenticated access to a WordPress account with permission to modify plugin settings. The attacker submits a crafted payload containing JavaScript through the vulnerable textarea or input fields. When an administrator views the settings page, the script executes in the admin browser context. User interaction is required, as the payload only triggers when the affected page is loaded.

The vulnerability mechanism is described in detail in the Exploit-DB #48656 entry and the VulnCheck Advisory on Powie's Plugin. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2020-37225

Indicators of Compromise

• Unexpected <script> tags, event handlers, or encoded JavaScript stored in wp_options rows associated with the pwhois_ prefix
• Unusual administrator account creation or role changes following access to the plugin settings page
• Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading pwhois_settings.php

Detection Strategies

• Review WordPress database entries for the plugin's option keys and search for HTML or JavaScript content that should not appear in configuration values
• Monitor WordPress audit logs for update_option actions targeting Powie's WHOIS plugin settings by non-administrator accounts
• Inspect web server access logs for POST requests to wp-admin/admin.php with the pwhois_settings page parameter

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture settings changes with full payload visibility
• Deploy a web application firewall rule to flag script tags and JavaScript event handlers in plugin settings POST bodies
• Alert on creation of new administrator accounts and on modifications to the wp_users and wp_usermeta tables outside change windows

How to Mitigate CVE-2020-37225

Immediate Actions Required

• Disable or remove Powie's WHOIS Domain Check plugin version 0.9.31 until a patched version is verified
• Rotate WordPress administrator passwords and invalidate active sessions on any site where the plugin was active
• Audit the wp_options table for stored payloads and remove malicious entries before re-enabling the plugin

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2020-37225. Administrators should consult the WordPress Plugin Overview and Powie Security Insights for the latest plugin release and verify that input handling in pwhois_settings.php applies WordPress sanitization functions before deploying any update.

Workarounds

• Restrict access to the WordPress admin dashboard using IP allowlists or VPN-only access to limit who can reach the vulnerable settings page
• Apply the principle of least privilege by removing plugin configuration capabilities from non-essential accounts
• Deploy a Content Security Policy (CSP) header that disallows inline scripts in the WordPress admin context to reduce XSS impact

# Configuration example: WAF rule pattern to block script payloads in plugin settings
# Block POST requests to plugin settings containing HTML script tags or event handlers
SecRule REQUEST_URI "@contains pwhois_settings" \
    "chain,deny,status:403,id:1002020372251,msg:'CVE-2020-37225 XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)"