CVE-2025-24576: Landing Page Cat XSS Vulnerability

CVE-2025-24576 Overview

CVE-2025-24576 is a reflected cross-site scripting (XSS) vulnerability in the fatcatapps Landing Page Cat WordPress plugin. The flaw affects all versions of landing-page-cat up to and including 1.7.7. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in a victim's browser. The vulnerability is categorized as [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Exploitation requires user interaction, typically through a crafted link, and operates over the network without authentication.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, or redirection to attacker-controlled infrastructure.

Affected Products

fatcatapps Landing Page Cat WordPress plugin versions up to and including 1.7.7
WordPress installations with the landing-page-cat plugin enabled
All sites exposing vulnerable plugin endpoints to unauthenticated visitors

Discovery Timeline

2025-02-03 - CVE-2025-24576 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24576

Vulnerability Analysis

The vulnerability stems from improper input sanitization in the Landing Page Cat plugin. User-controlled parameters are reflected directly into HTTP responses without encoding or filtering. Attackers can craft a URL containing JavaScript payloads that the plugin echoes back into the rendered HTML.

When a victim clicks the crafted link, the browser executes the injected script in the context of the vulnerable site's origin. The attack scope changes because the malicious script runs under the trust boundary of the targeted WordPress domain.

Root Cause

The plugin's request handlers fail to apply WordPress sanitization functions such as esc_html(), esc_attr(), or sanitize_text_field() to parameters before outputting them to the response body. This omission permits raw HTML and JavaScript to flow from the request directly into the page DOM.

Attack Vector

An attacker constructs a URL targeting a vulnerable endpoint of the Landing Page Cat plugin with a JavaScript payload embedded in a query parameter. The attacker delivers the link through phishing emails, malicious advertising, or social media posts. When an authenticated administrator or any visitor clicks the link, the injected script executes within their browser session.

Potential outcomes include theft of session cookies, account takeover via forged administrative actions, drive-by malware delivery, and defacement of the rendered page. See the Patchstack Security Advisory for additional technical context.

Detection Methods for CVE-2025-24576

Indicators of Compromise

HTTP requests to Landing Page Cat plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: strings in query parameters
Web server access logs showing referrers from untrusted domains followed by requests to landing-page-cat paths
Unexpected outbound connections from administrator browsers after visiting WordPress admin pages
WordPress audit logs showing unauthorized configuration changes following administrator clicks on external links

Detection Strategies

Inspect HTTP request and response bodies for reflected payloads originating from the landing-page-cat plugin
Deploy web application firewall (WAF) rules that flag XSS payload patterns targeting WordPress plugin parameters
Correlate browser-side anomalies, such as unexpected script execution, with recent visits to plugin-served pages

Monitoring Recommendations

Enable verbose WordPress and web server logging for all requests reaching landing-page-cat endpoints
Forward web access logs to a centralized analytics platform for real-time pattern matching against XSS signatures
Alert on administrator sessions performing privileged actions immediately after referrals from external domains

How to Mitigate CVE-2025-24576

Immediate Actions Required

Identify all WordPress instances running the Landing Page Cat plugin and confirm version 1.7.7 or earlier
Disable or remove the plugin until a patched release is available and verified
Force password resets and invalidate active sessions for administrators who may have clicked untrusted links
Review WordPress audit logs for unauthorized changes made during the exposure window

Patch Information

A fixed version had not been published in the vendor advisory at the time of NVD publication. Monitor the Patchstack advisory and the WordPress.org plugin repository for an updated release beyond 1.7.7, and apply it promptly.

Workarounds

Deactivate the Landing Page Cat plugin until a vendor patch is available
Deploy WAF rules that block requests containing common XSS payload patterns targeting plugin parameters
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Train administrators to avoid clicking unsolicited links to their own WordPress site

bash

# Example WAF rule pattern to block reflected XSS attempts targeting the plugin
# ModSecurity rule snippet
SecRule REQUEST_URI "@contains landing-page-cat" \
    "chain,phase:2,deny,status:403,id:1024576,msg:'CVE-2025-24576 XSS attempt blocked'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"