CVE-2025-22517: List Pages at Depth XSS Vulnerability

CVE-2025-22517 Overview

CVE-2025-22517 is a stored Cross-Site Scripting (XSS) vulnerability in the Ben Huson List Pages at Depth WordPress plugin. The flaw affects all versions up to and including 1.5. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing the affected pages. Because the scope changes across a security boundary, exploitation impacts users beyond the attacker's own session.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in other users' browser sessions, enabling session theft, credential harvesting, and unauthorized actions in the WordPress site context.

Affected Products

Ben Huson List Pages at Depth (list-pages-at-depth) WordPress plugin
All versions from n/a through 1.5
WordPress installations with the plugin enabled

Discovery Timeline

2025-01-07 - CVE-2025-22517 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22517

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the List Pages at Depth plugin for WordPress. The plugin fails to properly sanitize or encode user-controlled input before writing it into rendered HTML output. An attacker with contributor-level or similar low-privilege access can submit crafted input containing JavaScript. That payload is stored server-side and later rendered without adequate escaping when a victim visits an affected page.

The stored nature of the flaw makes it more impactful than reflected XSS. The payload persists in the site's database and triggers on every page load. Because user interaction is required and the scope is changed, an administrator visiting affected content can have their session hijacked or be forced to perform privileged actions.

Root Cause

The root cause is missing output encoding and inadequate input validation in the plugin's page-listing rendering logic. Plugin code paths concatenate stored values into HTML markup without applying WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses(). This allows any HTML or script tags in the stored data to be interpreted by the browser as executable content.

Attack Vector

The attack is network-reachable and requires low-level authentication plus user interaction. An attacker submits a malicious payload through an input field that the plugin later renders. When a higher-privileged user, such as an editor or administrator, loads the page displaying the listed content, the injected script executes in their session.

Typical stored XSS payloads targeting WordPress abuse the administrator context to create rogue accounts, exfiltrate wp_options values, or install malicious plugins via the REST API. See the Patchstack XSS Vulnerability Advisory for additional context on this specific weakness.

Detection Methods for CVE-2025-22517

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored within WordPress wp_posts or plugin-managed tables
Outbound HTTP requests from administrator browser sessions to unfamiliar domains shortly after loading pages that use the plugin
New administrator accounts or unauthorized changes to wp_users and wp_usermeta without a corresponding legitimate action
Modifications to plugin or theme files timestamped after suspicious content submissions by low-privileged users

Detection Strategies

Query the WordPress database for stored content containing HTML event handlers or <script> tags submitted by non-administrator accounts
Review web server access logs for POST requests to plugin endpoints originating from contributor or author accounts
Enable and inspect WordPress audit logs to correlate content edits by low-privilege users with administrator page views

Monitoring Recommendations

Deploy a Content Security Policy (CSP) that reports violations to a central endpoint to surface injected inline scripts
Monitor for anomalous administrative API calls that follow user interaction with plugin-rendered pages
Alert on plugin file integrity changes and on new privileged account creation events in WordPress

How to Mitigate CVE-2025-22517

Immediate Actions Required

Deactivate and remove the List Pages at Depth plugin from all WordPress sites until a fixed release is verified
Audit stored content across the site for injected scripts or HTML event handlers and remove any malicious entries
Rotate credentials and invalidate active sessions for administrators who may have viewed affected pages
Review WordPress user accounts for unauthorized additions or role escalations

Patch Information

At the time of publication, the advisory indicates the vulnerability affects all versions through 1.5 with no fixed version listed. Monitor the Patchstack advisory and the WordPress plugin repository for an official patched release. Apply updates immediately once available.

Workarounds

Remove the plugin entirely if no patched version is available
Restrict content submission capabilities to trusted, fully verified accounts and disable contributor-level roles where possible
Deploy a web application firewall (WAF) with rules that block common XSS payload patterns targeting WordPress plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins

bash

# Disable the vulnerable plugin via WP-CLI until a patched version is released
wp plugin deactivate list-pages-at-depth
wp plugin delete list-pages-at-depth

# Search the database for stored script payloads potentially injected via the plugin
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"