CVE-2025-12037: WP 404 Auto Redirect XSS Vulnerability

CVE-2025-12037 Overview

CVE-2025-12037 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP 404 Auto Redirect to Similar Post plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.5. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's admin settings interface. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when other users access affected pages. The issue is classified under CWE-79.

Critical Impact
Exploitation requires administrator privileges and only affects WordPress multisite installations or sites where the unfiltered_html capability has been disabled.

Affected Products

WP 404 Auto Redirect to Similar Post plugin for WordPress (all versions ≤ 1.0.5)
WordPress multisite installations running the affected plugin
WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

2026-02-18 - CVE-2025-12037 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12037

Vulnerability Analysis

The WP 404 Auto Redirect to Similar Post plugin fails to properly sanitize input and escape output on its admin settings pages. An authenticated administrator can submit payloads containing HTML and JavaScript through the plugin's configuration fields. The plugin stores this input without filtering and later renders it without escaping, resulting in stored XSS.

WordPress administrators normally hold the unfiltered_html capability, allowing them to legitimately submit HTML and JavaScript. This makes the vulnerability irrelevant in standard single-site installations. However, in multisite environments, only Super Admins receive unfiltered_html by default, restricting regular site administrators. The vulnerability becomes exploitable in this lower-privilege administrator context.

Root Cause

The root cause is missing input sanitization on plugin settings before persistence and missing output escaping when rendering stored values. WordPress provides sanitization functions such as sanitize_text_field() and escaping functions such as esc_attr() and esc_html(). The plugin did not apply these functions consistently to administrator-supplied input.

Attack Vector

An authenticated attacker with administrator-level access on a multisite installation, or on a site where unfiltered_html is disabled, submits a malicious script payload through the plugin's admin settings form. The payload is stored in the WordPress options table. When any user with access to the affected admin or page view loads the rendered content, the browser executes the injected script in the victim's session context. Successful exploitation can lead to session theft, administrative action forgery, or redirection to attacker-controlled infrastructure.

No verified public proof-of-concept code has been published. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-12037

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes stored in the WordPress wp_options table entries belonging to the plugin
Outbound browser requests from administrator sessions to unknown third-party domains when visiting pages rendered by the plugin
Plugin settings modified by administrator accounts not authorized to make configuration changes

Detection Strategies

Inspect plugin settings in the WordPress database for HTML or JavaScript content within fields intended to hold plain text or URLs
Review WordPress audit logs for update_option events tied to the WP 404 Auto Redirect to Similar Post plugin
Monitor the rendered HTML output of plugin-controlled pages for script tags or inline event handlers that were not present in prior baselines

Monitoring Recommendations

Enable a WordPress activity logging plugin to track administrator setting changes and user role modifications
Deploy a web application firewall with rules covering stored XSS submission patterns against /wp-admin/options.php
Forward WordPress and web server logs to a centralized analytics platform for correlation of administrator activity with anomalous client-side script execution

How to Mitigate CVE-2025-12037

Immediate Actions Required

Update the WP 404 Auto Redirect to Similar Post plugin to a version newer than 1.0.5 once the vendor releases a fix
Audit all administrator accounts on multisite installations and remove unused privileged users
Review the wp_options table for previously injected payloads and remove any malicious stored content
Rotate session cookies and administrator credentials if compromise is suspected

Patch Information

At the time of publication, refer to the WordPress Plugin Change Log for the latest patched release. Apply the fixed version across all sites in any multisite network. Verify the plugin's version after update by checking the WordPress plugins administration page.

Workarounds

Deactivate and remove the WP 404 Auto Redirect to Similar Post plugin until a patched version is installed
Restrict administrator privileges on multisite networks to trusted Super Admins only
Apply a Content Security Policy (CSP) header that disallows inline script execution on /wp-admin/ pages
Enforce the DISALLOW_UNFILTERED_HTML constant review and limit which roles can edit plugin settings

bash

# Configuration example: enforce CSP for WordPress admin via .htaccess
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"
</IfModule>