CVE-2025-24558: CRM Perks support-x XSS Vulnerability

CVE-2025-24558 Overview

CVE-2025-24558 is a reflected Cross-Site Scripting (XSS) vulnerability in the CRM Perks support-x WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can craft a malicious URL that, when clicked by an authenticated or unauthenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability affects all versions of the plugin up to and including 1.1.5. Exploitation requires user interaction, but the scope change in the CVSS vector indicates impact extends beyond the vulnerable component.

Critical Impact
Successful exploitation enables attackers to execute arbitrary scripts in a victim's browser, leading to session theft, credential harvesting, and unauthorized actions performed under the victim's WordPress privileges.

Affected Products

CRM Perks support-x WordPress plugin versions through 1.1.5
WordPress sites with the vulnerable plugin installed and activated
Any browser session of users interacting with crafted plugin URLs

Discovery Timeline

2025-02-14 - CVE-2025-24558 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24558

Vulnerability Analysis

The vulnerability is classified as Reflected Cross-Site Scripting [CWE-79]. The support-x plugin reflects user-controlled input back into HTTP responses without applying adequate output encoding or input sanitization. When a victim loads a crafted URL containing malicious JavaScript payloads, the plugin renders the payload as part of the web page, causing the browser to execute the script in the context of the WordPress site origin.

The attack requires user interaction, meaning the victim must click a malicious link or visit a prepared page. The scope change indicates that the executed payload can affect resources beyond the vulnerable plugin, such as WordPress administrative functions accessible through the same origin.

Root Cause

The root cause is missing or insufficient sanitization of request parameters before they are echoed into HTML responses. The plugin fails to apply WordPress functions such as esc_html(), esc_attr(), or wp_kses() to untrusted input prior to rendering. As a result, attacker-controlled markup and script tags are preserved in the response body.

Attack Vector

An attacker constructs a URL targeting a vulnerable plugin endpoint with a JavaScript payload embedded in a parameter. The attacker then delivers the URL through phishing emails, malicious advertisements, or third-party site links. When an authenticated WordPress administrator clicks the link, the payload executes with their privileges, potentially creating new admin accounts, installing malicious plugins, or exfiltrating session cookies.

No verified public proof-of-concept code is available. Refer to the Patchstack Security Advisory for additional technical context.

Detection Methods for CVE-2025-24558

Indicators of Compromise

Web server access logs containing requests to support-x plugin endpoints with suspicious query parameters such as <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E)
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after clicking external links
Creation of new WordPress administrator accounts or modification of plugin and theme files without a corresponding admin action

Detection Strategies

Monitor WordPress access logs for HTTP GET requests targeting support-x plugin paths containing script tags, event handlers, or encoded JavaScript payloads
Deploy a Web Application Firewall (WAF) with rules that flag reflected XSS patterns in query strings and POST bodies
Review browser Content Security Policy (CSP) violation reports for blocked inline script executions on pages served by the plugin

Monitoring Recommendations

Enable WordPress audit logging to track administrator session activity, user creation events, and plugin or theme modifications
Forward web server and WordPress logs to a centralized SIEM for correlation with phishing indicators and outbound traffic anomalies
Alert on any access to plugin URLs followed immediately by privileged WordPress configuration changes from the same session

How to Mitigate CVE-2025-24558

Immediate Actions Required

Update the CRM Perks support-x plugin to a version later than 1.1.5 once a patched release is available from the vendor
Deactivate and remove the plugin if a fixed version is not yet available and the functionality is not business-critical
Audit WordPress administrator accounts and recent configuration changes for signs of unauthorized activity

Patch Information

The vulnerability affects all support-x versions up to and including 1.1.5. Administrators should consult the Patchstack Security Advisory and the vendor's WordPress.org plugin page for the latest patched release information.

Workarounds

Deploy a WAF with rules that block reflected XSS payloads, including <script> tags, event handlers, and encoded variants in query parameters targeting the plugin
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Train WordPress administrators to avoid clicking unsolicited links and to use separate browser profiles for site administration

bash

# Example nginx WAF-style rule to block obvious XSS patterns in support-x requests
location ~* /wp-content/plugins/support-x/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}