CVE-2025-23833: Links/Problem Reporter DOM-Based XSS Vulnerability

CVE-2025-23833 Overview

CVE-2025-23833 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the RaminMT Links/Problem Reporter WordPress plugin, also known as report-broken-links. The flaw stems from improper neutralization of input during web page generation, tracked as [CWE-79]. All plugin versions up to and including 2.6.0 are affected. Successful exploitation allows an attacker to inject malicious script content that executes in the victim's browser context. The vulnerability requires user interaction and low-privileged authenticated access, and its scope change means an attacker can affect resources beyond the vulnerable component.

Critical Impact
Authenticated attackers with low privileges can trigger DOM-based script execution in a victim's browser, enabling session theft, credential harvesting, or unauthorized actions across the WordPress site.

Affected Products

RaminMT Links/Problem Reporter (report-broken-links) WordPress plugin
All versions from initial release through 2.6.0
WordPress installations with the plugin enabled

Discovery Timeline

2025-01-16 - CVE-2025-23833 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23833

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in the report-broken-links plugin. DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper encoding or sanitization. Unlike reflected or stored XSS, the malicious payload is never processed by the server, which complicates detection through traditional web application firewall rules.

An attacker crafts a URL or interaction that causes the plugin's client-side code to render unsanitized input into the page. When a victim follows the crafted link, the browser parses the injected markup and executes attacker-supplied JavaScript. The scope change reflected in the vulnerability metrics indicates that a successful attack can compromise data or functionality outside the plugin's own security boundary, such as the broader WordPress admin session.

Root Cause

The root cause is missing or insufficient output encoding in the plugin's JavaScript when handling data sources such as location, document.URL, or DOM element values. Input flows into sinks like innerHTML, document.write, or eval without being escaped for the HTML context. Refer to the Patchstack Vulnerability Report for technical detail.

Attack Vector

Exploitation is network-based and requires an authenticated user with low privileges plus victim interaction. A typical scenario involves an attacker crafting a URL containing a malicious payload in a query parameter or fragment. The attacker sends the link to a WordPress user through phishing or another channel. When the victim clicks the link and visits a page where the plugin renders the value client-side, the payload executes in the victim's browser.

// Example exploitation code (sanitized)
The vulnerability manifests when client-side JavaScript in the plugin
reads user-controlled data (URL parameters, fragments, or form input)
and injects it into the DOM through unsafe sinks without HTML encoding.
See the Patchstack advisory for the specific parameter and sink details.

Detection Methods for CVE-2025-23833

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs in HTTP request parameters targeting pages that load the report-broken-links plugin
Anomalous outbound requests from browser sessions to attacker-controlled domains following visits to plugin pages
WordPress user accounts performing unexpected administrative actions shortly after clicking external links

Detection Strategies

Inspect web server access logs for URLs containing encoded script payloads such as %3Cscript%3E, onerror=, or javascript: targeting plugin endpoints
Deploy Content Security Policy (CSP) reporting to identify script execution attempts from untrusted sources
Review browser telemetry and endpoint detection logs for suspicious script execution originating from WordPress admin pages

Monitoring Recommendations

Enable WordPress audit logging to capture user activity on pages that load the vulnerable plugin
Monitor for creation of new administrative accounts or plugin installations following user link clicks
Correlate browser session anomalies with recent phishing indicators targeting site administrators

How to Mitigate CVE-2025-23833

Immediate Actions Required

Identify all WordPress sites running the report-broken-links plugin at version 2.6.0 or earlier
Deactivate and remove the plugin if a patched version is not available for your environment
Rotate credentials and session tokens for any users who may have interacted with suspicious links

Patch Information

At the time of NVD publication, the advisory identifies versions through 2.6.0 as vulnerable. Site administrators should consult the Patchstack Vulnerability Report and the plugin repository for the latest fixed release and upgrade guidance.

Workarounds

Disable the report-broken-links plugin until a patched version is installed
Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Restrict plugin-related pages to authenticated administrators only, using web server or WordPress role controls
Train users to avoid clicking untrusted links that reference WordPress admin URLs

bash

# Configuration example
# Add a restrictive Content-Security-Policy header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

# Or disable the plugin via WP-CLI until patched
wp plugin deactivate report-broken-links