CVE-2025-15000: Page Keys WordPress Plugin XSS Vulnerability

CVE-2025-15000 Overview

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the page_key parameter in all versions up to, and including, 1.3.3. The vulnerability exists due to insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

Critical Impact
Authenticated administrators can inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, unauthorized actions, or sensitive data theft on WordPress multisite installations.

Affected Products

Page Keys WordPress Plugin version 1.3.3 and earlier
WordPress Multisite installations with unfiltered_html disabled
Single-site WordPress installations where unfiltered_html has been explicitly disabled

Discovery Timeline

January 7, 2026 - CVE-2025-15000 published to NVD
January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15000

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability specifically targets multi-site WordPress installations and configurations where the unfiltered_html capability has been disabled.

The attack requires network access and high-level privileges (administrator), but once exploited, the injected scripts persist in the database and execute in a changed security context, potentially affecting users across the WordPress installation. The lack of proper input sanitization in the page_key parameter allows attackers to embed JavaScript or HTML content that bypasses normal security controls.

Root Cause

The root cause lies in insufficient input sanitization and output escaping within the ListTable.php file of the Page Keys plugin. The page_key parameter accepts user-supplied input without adequate validation, and when this data is rendered on the page, it is not properly escaped. This allows malicious script content to be stored in the database and subsequently executed when pages are accessed.

The vulnerability is particularly notable because it bypasses WordPress's built-in unfiltered_html restriction, which is designed to prevent even administrators from inserting arbitrary HTML in multisite environments.

Attack Vector

The attack is network-based and requires the attacker to have authenticated administrator access to the WordPress installation. The attacker crafts a malicious payload containing JavaScript code and submits it through the page_key parameter. Because the plugin fails to sanitize this input, the malicious script is stored in the database.

When any user—including other administrators or site visitors—accesses a page where the injected script has been stored, the malicious code executes in their browser context. This can lead to session cookie theft, phishing attacks, defacement, or further privilege escalation depending on the payload delivered.

The vulnerable code can be examined in the WordPress Plugin Code Snippet at line 260 of ListTable.php. The input from the page_key parameter is rendered without proper escaping using WordPress sanitization functions like esc_html() or esc_attr().

Detection Methods for CVE-2025-15000

Indicators of Compromise

Unexpected JavaScript code or HTML tags in page_key field values within the database
Unusual administrator activity related to the Page Keys plugin settings
Browser-based alerts or unexpected redirects when accessing WordPress admin pages
User reports of suspicious pop-ups or credential prompts on the WordPress site

Detection Strategies

Review WordPress database for suspicious entries in tables associated with the Page Keys plugin
Implement web application firewall (WAF) rules to detect XSS payloads in POST requests targeting Page Keys endpoints
Monitor server access logs for unusual activity patterns from authenticated administrator accounts
Deploy browser-side Content Security Policy (CSP) headers to restrict script execution sources

Monitoring Recommendations

Enable detailed WordPress audit logging to track all plugin configuration changes
Configure real-time alerts for modifications to the Page Keys plugin settings
Implement database integrity monitoring to detect unauthorized changes to stored page key values
Review administrator account activity regularly for signs of compromise or misuse

How to Mitigate CVE-2025-15000

Immediate Actions Required

Update the Page Keys plugin to a patched version when available from the WordPress plugin repository
Review existing page_key entries in the database for malicious content and sanitize any suspicious values
Temporarily disable the Page Keys plugin if the vulnerability cannot be immediately patched
Audit all administrator accounts for unauthorized access or compromised credentials

Patch Information

Users should monitor the Wordfence Vulnerability Report for official patch announcements and update instructions. The vulnerability affects version 1.3.3 and earlier of the Page Keys plugin. Check the WordPress plugin repository for the latest secure version.

Workarounds

Disable or remove the Page Keys plugin entirely until a patched version is released
Implement Content Security Policy (CSP) headers to mitigate the impact of any injected scripts
Restrict administrator access to trusted users only and enforce strong authentication
Use a web application firewall (WAF) to filter XSS payloads targeting the affected parameter

bash

# Example: Add Content Security Policy header in .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"

# Example: Disable the Page Keys plugin via WP-CLI
wp plugin deactivate page-keys

# Example: Check for suspicious entries in WordPress database
wp db query "SELECT * FROM wp_postmeta WHERE meta_key LIKE '%page_key%' AND meta_value LIKE '%<script%'"