CVE-2025-1561 Overview
CVE-2025-1561 is a Stored Cross-Site Scripting (XSS) vulnerability in the AppPresser – Mobile App Framework plugin for WordPress. The flaw affects all versions of the plugin up to and including 4.4.10. The root cause is insufficient input sanitization and output escaping on the title parameter processed by the plugin's logging component. Unauthenticated attackers can inject arbitrary web scripts that execute when a user views an affected page, provided logging is enabled on the site. The issue is tracked as [CWE-79] and was fixed in AppPresser 4.4.11.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into administrative log pages, enabling session theft, credential harvesting, or account takeover when an administrator views the injected content.
Affected Products
- AppPresser – Mobile App Framework plugin for WordPress, versions <= 4.4.10
- WordPress sites running AppPresser with logging enabled
- Any site aggregating unauthenticated request data through the AppPresser log admin interface
Discovery Timeline
- 2025-03-13 - CVE-2025-1561 published to the National Vulnerability Database
- 2025-03-13 - AppPresser 4.4.11 patch published via the WordPress plugin repository
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-1561
Vulnerability Analysis
The vulnerability resides in the AppPresser logging subsystem, specifically in AppPresser_Log_Admin.php. The plugin captures request data, including a title parameter, and persists it to the site's log storage. When an administrator later views the log through the plugin's admin interface, the stored title value is rendered without proper output escaping. Because attackers control the input and the sink is an administrative HTML context, injected <script> payloads execute in the administrator's browser session. The vulnerability requires user interaction, meaning the payload triggers when the admin opens the log view.
Root Cause
The root cause is missing input sanitization on inbound log data combined with missing output escaping when rendering the log entries. The vulnerable code path in templates/template.php and AppPresser_Log_Admin.php echoes the stored title value directly into the response. WordPress provides esc_html(), esc_attr(), and sanitize_text_field() helpers for exactly this purpose, but the vulnerable versions did not apply them to the title field. The fix in changeset 3254632 adds escaping before output.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request to a vulnerable WordPress endpoint handled by AppPresser, embedding a JavaScript payload in the title parameter. The plugin stores the payload in its log store. When a privileged user opens the AppPresser log admin page, the browser parses and executes the injected script in the origin of the WordPress site. The attacker can then exfiltrate session cookies, create new administrator accounts through the WordPress REST API, or pivot to further server-side compromise. Refer to the Wordfence Vulnerability Details and the WordPress Template PHP Code for the vulnerable sink.
Detection Methods for CVE-2025-1561
Indicators of Compromise
- HTTP requests to AppPresser endpoints containing <script, onerror=, javascript:, or encoded variants in the title parameter
- Unexpected new WordPress administrator accounts or modifications to wp_users following administrator visits to the AppPresser log page
- Outbound requests from an administrator's browser session to unknown domains immediately after opening the AppPresser log admin view
- Stored log entries in AppPresser tables containing HTML or JavaScript markup in the title column
Detection Strategies
- Inspect web server access logs for POST or GET requests to AppPresser handlers with suspicious title parameter values.
- Query the AppPresser log tables for entries whose title field contains angle brackets, event handlers, or URL-encoded script fragments.
- Deploy Web Application Firewall (WAF) signatures that match common XSS payloads targeting the title parameter on WordPress sites running AppPresser.
Monitoring Recommendations
- Alert on any administrator-context browser telemetry that shows script execution originating from /wp-admin pages associated with AppPresser.
- Monitor WordPress audit logs for privilege changes, user creation, and plugin modifications made shortly after log page views.
- Track the installed AppPresser version across managed WordPress instances and flag any host running a version below 4.4.11.
How to Mitigate CVE-2025-1561
Immediate Actions Required
- Update the AppPresser plugin to version 4.4.11 or later on every affected WordPress installation.
- Audit administrator accounts for unauthorized additions or role changes and rotate credentials for any account that accessed the AppPresser log page while running a vulnerable version.
- Clear or purge existing AppPresser log tables to remove any latent stored payloads before administrators view them again.
- Invalidate active WordPress sessions to revoke any cookies that may have been captured through prior exploitation.
Patch Information
AppPresser released version 4.4.11 addressing the vulnerability. The fix is documented in WordPress Changeset 4.4.11 and applies escaping to log output within AppPresser_Log_Admin.php. Administrators should apply the update through the WordPress plugin manager or by installing the patched release from the WordPress plugin repository.
Workarounds
- Disable AppPresser logging until the plugin is upgraded to 4.4.11 or later.
- Deactivate the AppPresser plugin entirely on sites where mobile app integration is not required.
- Place the WordPress site behind a WAF configured to block XSS payloads on requests handled by AppPresser endpoints.
# Update AppPresser using WP-CLI
wp plugin update apppresser --version=4.4.11
# Verify installed version
wp plugin get apppresser --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
