CVE-2025-12160: WordPress Simple User Registration XSS

CVE-2025-12160 Overview

CVE-2025-12160 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Simple User Registration plugin for WordPress. The flaw affects all versions up to and including 6.6. The plugin fails to properly sanitize input and escape output for the wpr_admin_msg parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when any user accesses an affected page. Because no authentication is required and the injected payload persists in stored content, the vulnerability can be used to hijack administrator sessions, redirect visitors, or deliver further client-side payloads.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of any visitor, including authenticated administrators.

Affected Products

WordPress Simple User Registration plugin versions up to and including 6.6
WordPress sites with the plugin active and exposed registration endpoints
Any administrator or visitor browser session that loads injected pages

Discovery Timeline

2025-11-21 - CVE-2025-12160 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12160

Vulnerability Analysis

The Simple User Registration plugin processes the wpr_admin_msg parameter without applying sufficient input sanitization or output escaping. An attacker can submit a crafted request containing HTML or JavaScript payloads in this parameter. The payload is stored by the plugin and later rendered to users without encoding, causing the browser to execute it within the trust context of the WordPress site.

Stored XSS in a registration workflow is particularly useful to attackers because administrators frequently review user-submitted content. When an administrator views an affected page, the injected script runs with that administrator's session, enabling actions such as creating new privileged accounts, modifying plugin settings, or planting backdoors in theme files.

Root Cause

The root cause is missing input validation on the wpr_admin_msg parameter combined with the absence of contextual output escaping when the value is rendered. WordPress provides sanitize_text_field() and esc_html() helpers for these purposes, but the affected code path does not apply them. The CVSS scope change reflects that script execution crosses from the vulnerable plugin into the broader browser context of any user viewing the page.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction beyond visiting an injected page. An attacker submits a request to the registration endpoint with a JavaScript payload embedded in the wpr_admin_msg field. The payload is stored and rendered to subsequent visitors. No special privileges or local access are required, which lowers the barrier to mass exploitation against exposed WordPress installations.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Analysis and the WordPress Trac Changeset for technical context on the fix.

Detection Methods for CVE-2025-12160

Indicators of Compromise

HTTP POST or GET requests containing wpr_admin_msg with <script>, onerror=, onload=, or javascript: substrings
New WordPress administrator accounts created shortly after suspicious requests to registration endpoints
Unexpected modifications to plugin or theme files following visits by administrators
Outbound browser requests from admin sessions to unfamiliar third-party domains

Detection Strategies

Inspect web server access logs for requests targeting Simple User Registration endpoints with HTML or script characters in the wpr_admin_msg parameter
Apply Web Application Firewall (WAF) rules that flag XSS payloads in request bodies and query strings
Scan the WordPress database for stored values containing <script, event handlers, or encoded equivalents in plugin tables and options

Monitoring Recommendations

Enable verbose logging on registration and admin pages to capture parameter values for forensic review
Monitor administrator account creation and role changes through audit logging plugins or SIEM correlation
Alert on browser-originated requests from admin sessions that target the REST API or wp-admin endpoints in unusual patterns

How to Mitigate CVE-2025-12160

Immediate Actions Required

Update the Simple User Registration plugin to a version later than 6.6 as soon as the vendor publishes a patched release
Disable the plugin if a patched version is not yet available and registration functionality is not business-critical
Audit existing user accounts for unauthorized administrators and review recent plugin and theme file changes
Force a password reset for all administrator accounts and invalidate active sessions

Patch Information

The fix is committed in the WordPress Trac Changeset 3396064 for the wp-registration plugin slug. Site administrators should install the patched release through the WordPress plugin updater and verify the installed version exceeds 6.6.

Workarounds

Deploy WAF rules that block requests containing script tags or JavaScript event handlers in the wpr_admin_msg parameter
Restrict access to the registration page using IP allow-listing or CAPTCHA challenges to limit unauthenticated submissions
Apply a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of injected payloads

bash

# Example nginx rule to block obvious XSS payloads targeting the vulnerable parameter
if ($args ~* "wpr_admin_msg=.*(<script|onerror=|onload=|javascript:)") {
    return 403;
}