CVE-2025-24544: Bitcoin and Altcoin Wallets XSS Flaw

CVE-2025-24544 Overview

CVE-2025-24544 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the dashed-slug.net Bitcoin and Altcoin Wallets plugin for WordPress. The plugin fails to neutralize user-supplied input during web page generation. Attackers can inject malicious scripts that execute in a victim's browser when the victim follows a crafted link. The flaw affects all plugin versions up to and including 6.3.1. Exploitation requires user interaction but no authentication, and the impact crosses a security scope boundary, affecting confidentiality, integrity, and availability of the rendered page context.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser session, enabling session hijacking, credential theft, and unauthorized wallet actions within the WordPress site context.

Affected Products

• dashed-slug.net Bitcoin and Altcoin Wallets WordPress plugin
• All versions from n/a through 6.3.1
• WordPress installations using the affected wallets plugin

Discovery Timeline

• 2025-02-03 - CVE-2025-24544 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24544

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Bitcoin and Altcoin Wallets plugin. The plugin echoes user-controlled input back into HTTP response pages without applying proper output encoding or input sanitization. An attacker crafts a URL containing JavaScript payload parameters and delivers it to a target through phishing or other social engineering. When the victim loads the URL, the unsanitized parameter is rendered into the HTML response and executed by the browser.

Because the attack vector is network-based and requires no privileges, any visitor — including site administrators — can be targeted. The scope change (S:C) indicates the injected script can affect resources beyond the vulnerable component, such as the broader WordPress administrative session. The EPSS probability for this issue is low, but reflected XSS in cryptocurrency-related plugins remains attractive for credential and wallet-action theft.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin uses request parameters in response output without applying WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). As a result, special characters including <, >, and quote characters survive into the rendered DOM and are interpreted as markup.

Attack Vector

The attack is delivered over the network and requires user interaction. The attacker hosts a malicious link or embeds it in a phishing message. When a logged-in WordPress user opens the link, the injected script executes with the privileges of that user's browser session. The vulnerability manifests in plugin endpoints that reflect query string or form values into the page. Refer to the Patchstack WordPress Vulnerability Report for technical details on the affected parameters.

No verified proof-of-concept code is publicly available for this advisory. The vulnerability follows the standard reflected XSS pattern in WordPress plugins that bypass core sanitization APIs.

Detection Methods for CVE-2025-24544

Indicators of Compromise

• Web server access logs containing requests to plugin endpoints with parameter values that include <script>, javascript:, onerror=, onload=, or URL-encoded equivalents such as %3Cscript%3E
• Outbound HTTP requests from administrator browsers to unfamiliar third-party domains immediately after visiting a wallet plugin URL
• Unexpected administrator actions in WordPress audit logs originating from a session that previously loaded a crafted wallet plugin URL

Detection Strategies

• Deploy a web application firewall (WAF) rule that inspects query parameters and POST bodies submitted to wallets plugin endpoints for HTML and JavaScript metacharacters
• Implement Content Security Policy (CSP) reporting to capture inline script execution attempts on plugin pages
• Correlate referrer headers pointing to external sources with subsequent privileged WordPress actions to surface phishing-driven exploitation

Monitoring Recommendations

• Monitor WordPress plugin version inventory and flag any installation of wallets at version 6.3.1 or earlier
• Alert on browser console errors or CSP violations originating from pages rendered by the Bitcoin and Altcoin Wallets plugin
• Track failed login attempts and session anomalies for users who interacted with crypto wallet plugin URLs

How to Mitigate CVE-2025-24544

Immediate Actions Required

• Upgrade the Bitcoin and Altcoin Wallets plugin to a version released after 6.3.1 that addresses CVE-2025-24544
• Audit WordPress administrator accounts for unauthorized actions and rotate credentials and session cookies
• Restrict access to WordPress administrative interfaces using IP allowlisting or VPN-only access where feasible

Patch Information

The vendor advisory is tracked through Patchstack. Site administrators should consult the Patchstack WordPress Vulnerability Report to confirm the fixed version and apply the plugin update through the WordPress dashboard. Verify the installed version after update using the Plugins page.

Workarounds

• Deactivate the Bitcoin and Altcoin Wallets plugin until the patched version is installed if cryptocurrency functionality is not business-critical
• Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
• Configure a WAF managed rule set with reflected XSS signatures to filter requests targeting wp-content/plugins/wallets/ paths

# Example NGINX rule to block obvious XSS payloads targeting the plugin
location ~* /wp-content/plugins/wallets/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}