CVE-2025-22549: WP Github Plugin Stored XSS Vulnerability

CVE-2025-22549 Overview

CVE-2025-22549 is a stored Cross-Site Scripting (XSS) vulnerability in the seinoxygen WP Github WordPress plugin. The flaw affects all versions of the wp-github plugin up to and including 1.3.3. It results from Improper Neutralization of Input During Web Page Generation [CWE-79], allowing an authenticated attacker with low privileges to inject persistent JavaScript payloads that execute in a victim's browser session.

Critical Impact
Attackers with low-privileged access can store malicious scripts that execute against site visitors and administrators, enabling session theft, forced actions, and further compromise of the WordPress site.

Affected Products

seinoxygen WP Github plugin for WordPress
All versions from initial release through 1.3.3
WordPress sites with the wp-github plugin installed and active

Discovery Timeline

2025-01-07 - CVE-2025-22549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22549

Vulnerability Analysis

The vulnerability resides in the WP Github plugin's handling of user-supplied input rendered into WordPress pages. The plugin fails to properly sanitize and encode input before storing it and outputting it in the web page context. This allows attacker-controlled JavaScript to persist in the database and execute whenever the affected page is loaded.

Stored XSS is more damaging than reflected variants because payloads execute against every user who accesses the affected page. The attack requires low-privileged authentication and user interaction, but a scope change means the payload can affect resources beyond the vulnerable component, including administrator sessions.

Root Cause

The root cause is missing or insufficient output encoding in the plugin's page-generation logic. Input accepted through plugin-controlled fields is written into the response HTML without applying WordPress escaping primitives such as esc_html(), esc_attr(), or wp_kses(). Any HTML or script markup submitted by an authenticated user is preserved verbatim and rendered by the browser as executable content.

Attack Vector

An authenticated attacker with at least contributor-level privileges submits a crafted payload through a plugin-controlled input field. The payload is stored server-side and delivered to any user browsing the affected page. When a WordPress administrator views the malicious content, the injected script runs with the administrator's privileges, enabling session hijacking, plugin manipulation, arbitrary content modification, or lateral movement into other WordPress-connected systems.

The vulnerability requires no specialized tooling. See the Patchstack WP GitHub Plugin XSS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-22549

Indicators of Compromise

Presence of <script> tags, event handlers (onerror, onload, onclick), or javascript: URIs within wp_posts, wp_postmeta, or wp_options rows associated with the wp-github plugin.
Unexpected outbound HTTP requests from admin browser sessions immediately after loading pages managed by WP Github.
Creation of new administrator accounts or unexpected plugin installations following visits by privileged users.
Access log entries showing low-privileged accounts posting HTML-encoded payloads to plugin endpoints.

Detection Strategies

Query the WordPress database for stored plugin content containing HTML tags, JavaScript keywords, or encoded script fragments.
Deploy a Web Application Firewall (WAF) with rules that flag script injection patterns targeting wp-admin and plugin-specific endpoints.
Correlate authenticated POST requests from low-privileged roles with subsequent administrator session anomalies.
Review WordPress audit logs for unexpected content changes on posts, pages, or options tied to the wp-github plugin.

Monitoring Recommendations

Enable a WordPress activity log plugin to record content changes, user role modifications, and plugin edits.
Monitor administrator browser telemetry for script execution from WordPress-hosted pages against unfamiliar external domains.
Alert on any modification of wp_options values that contain HTML markup or JavaScript strings.
Track version inventory of the wp-github plugin across managed WordPress sites to flag unpatched installations.

How to Mitigate CVE-2025-22549

Immediate Actions Required

Identify all WordPress instances running the wp-github plugin at version 1.3.3 or earlier.
Deactivate and remove the plugin if a patched release is not available or not required for site functionality.
Audit existing plugin-managed content for injected scripts and remove any suspicious payloads.
Rotate administrator credentials and invalidate active sessions on affected sites.

Patch Information

No fixed version is listed in the advisory at time of publication. The vulnerability affects the wp-github plugin through version 1.3.3. Consult the Patchstack advisory for the latest remediation status and confirm any vendor updates from the plugin author before reinstalling.

Workarounds

Uninstall the WP Github plugin until a vendor-supplied patch is available.
Restrict contributor, author, and editor accounts to trusted users only, reducing the pool of accounts able to exploit the flaw.
Deploy a WAF ruleset that blocks HTML and JavaScript payloads submitted to plugin endpoints.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and untrusted script sources on the WordPress front end and admin area.

bash

# Example: disable and remove the vulnerable plugin using WP-CLI
wp plugin deactivate wp-github
wp plugin delete wp-github

# Verify removal
wp plugin list | grep wp-github