CVE-2025-23716: Login Watchdog Stored XSS Vulnerability

CVE-2025-23716 Overview

CVE-2025-23716 is a stored cross-site scripting (XSS) vulnerability in the JkmAS Login Watchdog WordPress plugin. The flaw affects all versions up to and including 1.0.4. Attackers can inject persistent JavaScript payloads that execute in the browsers of users viewing the affected pages.

The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Successful exploitation requires user interaction but no authentication, and the impact crosses a security scope boundary, affecting confidentiality, integrity, and availability.

Critical Impact
Unauthenticated attackers can plant persistent JavaScript that executes in administrator browsers, enabling session hijacking, account takeover, and further compromise of the WordPress site.

Affected Products

JkmAS Login Watchdog WordPress plugin versions through 1.0.4
WordPress sites with the login-watchdog plugin installed and active
Administrator and user sessions interacting with vulnerable plugin pages

Discovery Timeline

2025-03-03 - CVE-2025-23716 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23716

Vulnerability Analysis

The Login Watchdog plugin fails to neutralize user-supplied input before rendering it within generated web pages. The plugin stores attacker-controlled data and later reflects it into HTML output without sufficient sanitization or context-aware encoding. This allows arbitrary HTML and JavaScript to persist in the database and execute when a victim loads the affected page.

Because the payload is stored, exploitation does not require ongoing attacker presence. Each visit to the affected page triggers payload execution in the victim's browser session. The vulnerability carries an EPSS score of 0.346% (57th percentile), indicating modest near-term exploitation likelihood.

Root Cause

The root cause is missing or insufficient output encoding when rendering user-controlled fields in plugin-generated pages. WordPress provides escaping helpers such as esc_html(), esc_attr(), and wp_kses() for safe output. The plugin omits these protections on at least one input path through version 1.0.4.

Attack Vector

An unauthenticated attacker submits a crafted payload to a Login Watchdog endpoint that records the input. The plugin stores the payload, often in log entries tied to login attempts. When an administrator or other user later views the affected interface, the browser parses and executes the injected script in the site's origin context.

The vulnerability mechanism follows the standard stored XSS pattern. See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-23716

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes (onerror, onload) stored in WordPress database tables associated with the login-watchdog plugin
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after accessing plugin pages
New or modified WordPress administrator accounts created without legitimate workflow

Detection Strategies

Audit plugin-related database rows for HTML tags or JavaScript syntax in fields expected to contain plaintext such as IP addresses or usernames
Inspect web server logs for login requests with HTML or JavaScript metacharacters in headers like User-Agent, X-Forwarded-For, or login form fields
Use Web Application Firewall (WAF) rules to flag XSS payload patterns targeting WordPress login endpoints

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script execution anomalies in WordPress admin pages
Track plugin file integrity and version status across managed WordPress deployments
Correlate browser-side errors and unusual DOM modifications with administrator activity using endpoint telemetry

How to Mitigate CVE-2025-23716

Immediate Actions Required

Identify all WordPress sites running the Login Watchdog plugin at version 1.0.4 or earlier
Deactivate and remove the plugin until a patched release is confirmed available from the vendor
Review plugin-managed database tables and purge stored entries containing HTML or script content
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

At the time of NVD publication, no fixed version beyond 1.0.4 is referenced in the advisory. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release that applies proper output encoding.

Workarounds

Deploy a WAF with rules blocking XSS payloads on wp-login.php and plugin-specific endpoints
Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin interface
Restrict access to the WordPress administrative interface by IP allowlist where feasible

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate login-watchdog
wp plugin delete login-watchdog