CVE-2025-23645: Find Content IDs XSS Vulnerability

CVE-2025-23645 Overview

CVE-2025-23645 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Optimize Worldwide Find Content IDs WordPress plugin. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability affects all versions of the plugin up to and including 1.0. Exploitation requires user interaction but no privileges, and impacts confidentiality, integrity, and availability through scope change.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed on behalf of WordPress users who click attacker-supplied links.

Affected Products

Optimize Worldwide Find Content IDs WordPress plugin
Versions from n/a through 1.0 (inclusive)
WordPress sites with the find-content-ids plugin installed and active

Discovery Timeline

2025-02-04 - CVE CVE-2025-23645 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23645

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the Find Content IDs plugin for WordPress. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back into the rendered HTML response. An attacker crafts a URL containing JavaScript payloads in vulnerable request parameters. When a victim visits the URL, the browser executes the injected script within the trust context of the WordPress site.

The scope change indicator means the injected payload can affect resources beyond the vulnerable component, including the broader WordPress administrative interface. Reflected XSS in WordPress plugin contexts commonly enables theft of session cookies, forced administrative actions through CSRF chaining, and arbitrary content modification.

Root Cause

The root cause is missing output encoding and input validation on parameters processed by the find-content-ids plugin. User-controlled input flows directly from HTTP request parameters into HTML output without contextual escaping. This violates standard secure coding practices for web page generation [CWE-79].

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted link through phishing emails, social media, or malicious websites. When an authenticated WordPress user clicks the link, the embedded JavaScript executes in their browser. No authentication is required from the attacker to craft the payload. See the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23645

Indicators of Compromise

Web server access logs containing requests to find-content-ids plugin endpoints with HTML or JavaScript meta-characters such as <script>, onerror=, or javascript: in query parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following clicks on suspicious links.
WordPress user session anomalies, including unauthorized administrative actions or new privileged account creation.

Detection Strategies

Deploy a Web Application Firewall (WAF) with rules that identify reflected XSS payload patterns in WordPress plugin request parameters.
Review HTTP referrer headers and request strings for URL-encoded script tags and event handler attributes targeting the plugin.
Correlate browser console errors and Content Security Policy (CSP) violation reports with plugin endpoint access patterns.

Monitoring Recommendations

Enable verbose access logging on WordPress instances and forward logs to a centralized analytics platform for query parameter inspection.
Monitor administrator account activity for unusual session behaviors immediately after link clicks from external sources.
Track outbound DNS and HTTP requests from administrator workstations to identify data exfiltration channels established through XSS payloads.

How to Mitigate CVE-2025-23645

Immediate Actions Required

Deactivate and remove the Find Content IDs plugin from all WordPress installations until a patched version is released.
Audit WordPress administrator accounts for unauthorized changes, new users, or modified permissions.
Force password resets and invalidate active sessions for all privileged WordPress users.

Patch Information

No official patch is currently referenced in the available CVE data. The vulnerability affects all versions through 1.0. Monitor the Patchstack advisory and the WordPress plugin repository for updated releases from Optimize Worldwide.

Workarounds

Remove the find-content-ids plugin directory from /wp-content/plugins/ until a fix is published.
Implement a strict Content Security Policy (CSP) that disallows inline script execution and restricts script sources to trusted origins.
Deploy WAF rules that block requests containing script tags, event handlers, or javascript: URIs targeting plugin endpoints.
Restrict WordPress administrator access to dedicated browsers or sessions isolated from general browsing activity.

bash

# Configuration example - disable vulnerable plugin via WP-CLI
wp plugin deactivate find-content-ids
wp plugin delete find-content-ids

# Example nginx CSP header to mitigate XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;