CVE-2025-23777: GDPR Personal Data Reports Stored XSS Flaw

CVE-2025-23777 Overview

CVE-2025-23777 is a stored Cross-Site Scripting (XSS) vulnerability in the willowsconsulting GDPR Personal Data Reports plugin for WordPress. The flaw affects the gdpr-personal-data-reports plugin in all versions up to and including 1.0.5. It stems from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79].

An authenticated attacker with low privileges can inject malicious script content that persists in the application. When another user, including an administrator, views the affected page, the payload executes in their browser session. The scope-changed impact allows the payload to affect resources beyond the vulnerable component itself.

Critical Impact
Attackers with low-privileged accounts can inject persistent JavaScript that executes in the browsers of site administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

willowsconsulting GDPR Personal Data Reports plugin for WordPress
All versions from initial release through 1.0.5
WordPress sites with the gdpr-personal-data-reports plugin installed and activated

Discovery Timeline

2025-01-16 - CVE-2025-23777 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23777

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the GDPR Personal Data Reports plugin. Stored XSS occurs when an application accepts untrusted input, saves it to persistent storage, and later renders it in HTML output without proper encoding or sanitization.

Exploitation requires authentication with low-level privileges and some form of user interaction from the victim. Because the attack scope changes, the injected script executes in a security context different from the vulnerable component, expanding potential impact to administrator sessions or other privileged users.

The attack is delivered over the network against the WordPress site. Once the payload is stored, every subsequent visit to the affected page triggers script execution in the victim's browser without further attacker involvement.

Root Cause

The root cause is missing or insufficient output encoding on input handled by the plugin. User-controlled data is written to a database or configuration store and later reflected into HTML responses without contextual escaping. The plugin fails to apply WordPress sanitization APIs such as esc_html(), esc_attr(), or wp_kses() before rendering the value.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges. An attacker submits a payload containing HTML or JavaScript through an input field processed by the vulnerable plugin. The malicious content is stored on the server and executed when a legitimate user, typically an administrator, loads the affected view. Consult the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-23777

Indicators of Compromise

WordPress database entries associated with the gdpr-personal-data-reports plugin containing <script>, onerror=, onload=, or javascript: strings
Unexpected outbound HTTP requests from administrator browser sessions to attacker-controlled domains
New administrative user accounts or role changes shortly after low-privilege users interact with the plugin
Modified plugin, theme, or option records not correlated to authorized administrator activity

Detection Strategies

Inventory WordPress installations to identify any site running the gdpr-personal-data-reports plugin at version 1.0.5 or earlier
Review web server access logs for POST requests to plugin endpoints containing encoded script payloads
Inspect wp_options, wp_postmeta, and plugin-specific tables for HTML tags in fields that should hold plain text
Correlate authenticated low-privilege user activity with subsequent administrator session anomalies

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with rules that flag script tags and event handlers in request bodies
Monitor WordPress audit logs for content changes performed by subscriber, contributor, or author-level accounts
Alert on Content Security Policy (CSP) violations reported by administrator browsers
Track plugin version drift across managed WordPress sites to identify unpatched instances

How to Mitigate CVE-2025-23777

Immediate Actions Required

Identify all WordPress sites with the gdpr-personal-data-reports plugin installed and confirm the installed version
Deactivate and remove the plugin on any site running version 1.0.5 or earlier until a patched release is verified
Rotate credentials and invalidate active sessions for administrator accounts on affected sites
Audit user roles, posts, and plugin settings for unauthorized changes introduced through the vulnerability

Patch Information

At the time of publication, the advisory covers versions up through 1.0.5 and no fixed version is listed in the NVD entry. Consult the Patchstack Vulnerability Report and the plugin vendor for the latest fix status before reinstalling.

Workarounds

Uninstall the gdpr-personal-data-reports plugin until a patched version is available from willowsconsulting
Restrict plugin-related endpoints to trusted administrator IP addresses at the web server or WAF layer
Enforce a strict Content Security Policy that disallows inline scripts and untrusted external sources
Limit account provisioning so that only trusted users hold roles that can interact with the vulnerable plugin

bash

# Configuration example: remove the vulnerable plugin using WP-CLI
wp plugin deactivate gdpr-personal-data-reports
wp plugin uninstall gdpr-personal-data-reports

# Verify removal
wp plugin list | grep gdpr-personal-data-reports