CVE-2025-23474: Live Dashboard Reflected XSS Vulnerability

CVE-2025-23474 Overview

CVE-2025-23474 is a reflected Cross-Site Scripting (XSS) vulnerability in the Mike Martel Live Dashboard WordPress plugin. The flaw affects all versions up to and including 0.3.3 and stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session within the WordPress administrative context. The scope-changed CVSS rating reflects the impact on resources beyond the vulnerable component, including potential session compromise and administrative actions performed on behalf of the victim.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in administrator browsers, leading to session theft, account takeover, and unauthorized WordPress configuration changes.

Affected Products

Mike Martel Live Dashboard plugin for WordPress
All versions from initial release through 0.3.3
WordPress sites with the Live Dashboard plugin enabled

Discovery Timeline

2025-02-14 - CVE-2025-23474 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23474

Vulnerability Analysis

The Live Dashboard plugin fails to sanitize or encode user-supplied input before rendering it back into HTML responses. When a request parameter containing JavaScript reaches the affected output context, the browser interprets the payload as executable code rather than text. This is a classic reflected XSS pattern where the attack payload travels in a single request-response cycle and requires user interaction to trigger.

The vulnerability is categorized under [CWE-79], Improper Neutralization of Input During Web Page Generation. Reflected XSS in a WordPress plugin context is particularly impactful because plugin pages are often loaded within wp-admin, where the victim holds elevated privileges.

Root Cause

The root cause is missing output encoding in the plugin's request handler. User-controlled values are echoed into the response without calls to WordPress sanitization or escaping functions such as esc_html(), esc_attr(), or wp_kses(). Without these defenses, any HTML or script content provided by an attacker is rendered as part of the page DOM.

Attack Vector

Exploitation requires a network-reachable target and victim interaction. An attacker delivers a crafted link, often through phishing, social media, or a compromised referrer, that points to a vulnerable Live Dashboard endpoint with the malicious payload encoded in a parameter. When an authenticated WordPress user clicks the link, the injected script executes in their browser. The scope change in the CVSS vector reflects that the executed script can act on data and sessions beyond the plugin itself, including WordPress administrative cookies and CSRF tokens.

The exploitation flow involves three steps. First, the attacker identifies a reflected parameter on a Live Dashboard page. Second, the attacker URL-encodes a JavaScript payload and embeds it in the parameter. Third, the victim is induced to visit the URL while logged into WordPress, at which point the payload runs with the victim's privileges.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23474

Indicators of Compromise

HTTP requests to Live Dashboard plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: substrings in query parameters.
Outbound browser requests from administrator sessions to attacker-controlled domains shortly after visiting a Live Dashboard page.
Unexpected creation of WordPress administrator accounts or modification of plugin and theme files following a suspicious admin click event.

Detection Strategies

Inspect web server access logs for requests to plugin paths under /wp-content/plugins/live-dashboard/ containing reflected XSS signatures.
Deploy a Web Application Firewall (WAF) rule set such as OWASP CRS to flag and block parameters containing script tags or event handlers.
Correlate authenticated administrator referrer headers with external untrusted origins to identify likely phishing-driven exploitation.

Monitoring Recommendations

Enable WordPress audit logging to capture user, role, and option changes and alert on changes occurring within minutes of suspicious admin page loads.
Monitor browser Content Security Policy (CSP) violation reports for inline script execution attempts on wp-admin pages.
Track plugin version inventory across managed WordPress sites and alert on Live Dashboard installations at version 0.3.3 or earlier.

How to Mitigate CVE-2025-23474

Immediate Actions Required

Deactivate and remove the Live Dashboard plugin until a patched version is confirmed available from the maintainer.
Force password resets and invalidate active sessions for all WordPress administrators on affected sites.
Audit recent administrative activity, plugin installations, and user role changes for signs of post-exploitation tampering.

Patch Information

No fixed version is identified in the published advisory. The vulnerability affects Live Dashboard releases through 0.3.3. Site operators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for an official update. If no patch is forthcoming, replace the plugin with a maintained alternative.

Workarounds

Remove the plugin from production sites and rely on WordPress core dashboards or maintained alternatives until a fix is published.
Restrict access to /wp-admin by IP allowlist or VPN to reduce the attack surface for phishing-driven reflected XSS.
Deploy a WAF policy that blocks request parameters containing HTML tags or JavaScript event handlers targeted at plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts in administrative interfaces.

bash

# Example: disable the Live Dashboard plugin via WP-CLI
wp plugin deactivate live-dashboard
wp plugin delete live-dashboard

# Example: block reflected XSS payloads at the web server (nginx)
if ($args ~* "(<|%3C)script") {
    return 403;
}