CVE-2025-0860: Vruiz VR-Frases XSS Vulnerability

CVE-2025-0860 Overview

CVE-2025-0860 is a Reflected Cross-Site Scripting (XSS) vulnerability in the VR-Frases (collect & share quotes) plugin for WordPress. The flaw affects all versions up to and including 3.0.1 and stems from insufficient input sanitization and output escaping across several parameters. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a crafted link. The issue is classified under CWE-79. CVE-2025-22636 appears to be a duplicate of this issue.

Critical Impact
Attackers can hijack authenticated sessions, steal cookies, or perform actions in the context of a logged-in WordPress administrator by tricking them into clicking a malicious link.

Affected Products

vruiz VR-Frases (collect & share quotes) plugin for WordPress
All versions up to and including 3.0.1
WordPress sites with the plugin installed and active

Discovery Timeline

2025-01-30 - CVE-2025-0860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0860

Vulnerability Analysis

The VR-Frases plugin accepts user-controlled input through several parameters handled by the admin-facing code in includes/vr-frases-admin.php. The plugin reflects these parameter values back into rendered HTML output without applying proper sanitization functions such as sanitize_text_field() or output escaping via esc_attr() and esc_html(). As a result, an attacker can craft a URL containing JavaScript payloads in the vulnerable parameters. When an authenticated user, typically a site administrator, clicks the link, the payload executes in the browser under the origin of the WordPress site.

The attack requires user interaction but no privileges. Because the scope is changed, the impact extends beyond the vulnerable component to the wider WordPress session context.

Root Cause

The root cause is missing input sanitization and missing output escaping on multiple GET/POST parameters processed by the plugin. WordPress provides built-in helper functions to neutralize script content, but the plugin does not apply them consistently before echoing values into the response.

Attack Vector

An unauthenticated attacker constructs a URL pointing to a vulnerable plugin endpoint with a JavaScript payload placed in one of the reflected parameters. The attacker delivers the link through phishing email, social media, or a compromised third-party site. When a WordPress administrator visits the link while logged in, the browser executes the injected script. The script can exfiltrate session cookies, forge administrative requests, modify plugin settings, or plant a persistent backdoor by creating new administrative users.

No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Plugin File for technical context.

Detection Methods for CVE-2025-0860

Indicators of Compromise

HTTP requests to VR-Frases plugin endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= strings in query parameters
Referer headers on WordPress admin sessions pointing to external phishing domains that link to VR-Frases plugin URLs
Unexpected creation of new administrative WordPress users or modified plugin option values following an admin login
Outbound requests from an admin browser session to unknown external hosts immediately after clicking a link

Detection Strategies

Inspect web server access logs for query strings targeting VR-Frases plugin paths that include HTML tag characters (<, >, ") or encoded equivalents (%3C, %3E)
Deploy a Web Application Firewall (WAF) rule set that blocks reflected XSS payload patterns on WordPress URLs
Correlate WordPress wp-admin sessions with browser telemetry to identify script execution originating from plugin pages

Monitoring Recommendations

Monitor the WordPress wp_users and wp_options tables for unauthorized changes
Alert on POST requests to /wp-admin/ endpoints originating from unusual referrers
Track plugin version inventory across managed WordPress instances to identify hosts still running VR-Frases 3.0.1 or earlier

How to Mitigate CVE-2025-0860

Immediate Actions Required

Deactivate and remove the VR-Frases plugin from all WordPress installations until a patched version is confirmed available
Force a password reset and session invalidation for all WordPress administrator accounts on affected sites
Review recent administrator activity logs for signs of unauthorized configuration changes or new user accounts

Patch Information

As of the last NVD update on 2026-06-17, no fixed version beyond 3.0.1 has been published by the vendor. Site owners should consult the WordPress Changeset History and the Wordfence Vulnerability Report for updates.

Workarounds

Remove the plugin entirely if a patched release is not available
Restrict access to /wp-admin/ by IP allowlist to reduce the chance of administrators encountering crafted links from untrusted networks
Deploy a WAF with a rule blocking reflected XSS patterns on requests to plugin endpoints
Train administrators to avoid clicking WordPress admin links received from untrusted sources

bash

# Example WAF rule (ModSecurity) to block reflected XSS on VR-Frases endpoints
SecRule REQUEST_URI "@contains vr-frases" \
    "chain,phase:2,deny,status:403,id:1000860,msg:'Block CVE-2025-0860 XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni"