CVE-2025-24610: Restrict Anonymous Access Stored XSS Flaw

CVE-2025-24610 Overview

CVE-2025-24610 is a stored Cross-Site Scripting (XSS) vulnerability in the Christian Leuenberg Restrict Anonymous Access WordPress plugin. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). It affects all plugin versions up to and including 1.2. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page. Successful exploitation requires user interaction and can compromise session data, redirect visitors, or alter rendered content.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes across user sessions, enabling account hijacking, credential theft, and content manipulation within the affected WordPress site.

Affected Products

Christian Leuenberg Restrict Anonymous Access plugin for WordPress
All versions up to and including 1.2
WordPress installations using the restrict-anonymous-access plugin

Discovery Timeline

2025-01-24 - CVE-2025-24610 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24610

Vulnerability Analysis

The vulnerability results from improper neutralization of user-supplied input rendered within the plugin's web pages. The restrict-anonymous-access plugin fails to sanitize or escape input before it is stored and later reflected in HTML output. When an administrator or other privileged user views the affected page, the injected script executes in the context of the WordPress site's origin.

Stored XSS in a WordPress plugin extends the attack surface beyond a single request. Payloads persist in the database and execute automatically whenever a victim loads the affected view. The changed scope indicates the injected script can affect resources beyond the vulnerable component, including administrative sessions.

Root Cause

The plugin accepts input from an authenticated low-privilege user and writes it into the page without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). When the stored value is later rendered, the browser interprets embedded <script> tags or event handlers as executable code rather than inert text.

Attack Vector

The attack is executed remotely over the network. An authenticated user submits a crafted payload through a plugin form or setting field. The payload is stored in the WordPress database. When a victim loads the page that renders the stored value, the malicious script executes with the victim's privileges. Because the flaw crosses a security scope boundary, an attacker with contributor-level access can potentially target administrators.

No verified public proof-of-concept code is available. See the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-24610

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handler attributes stored in WordPress plugin option tables
Administrative sessions initiating unusual outbound HTTP requests immediately after loading plugin-managed pages
New administrative users or modified user roles created shortly after a privileged user accessed a page rendered by restrict-anonymous-access
Anomalous entries in wp_options or plugin-specific tables containing HTML or JavaScript characters

Detection Strategies

Inspect database records populated by the plugin for HTML control characters and script fragments
Enable WordPress audit logging to capture setting changes made by low-privilege accounts
Deploy a Content Security Policy (CSP) that reports violations, then triage CSP reports for inline script blocks originating from plugin pages
Monitor web server logs for POST requests to plugin endpoints followed by administrator GET requests to the same URLs

Monitoring Recommendations

Track authenticated request patterns from contributor and editor accounts targeting plugin configuration endpoints
Alert on browser telemetry showing script execution from unexpected DOM nodes on WordPress admin pages
Correlate WordPress user activity with endpoint telemetry to identify session token misuse following admin page loads

How to Mitigate CVE-2025-24610

Immediate Actions Required

Identify all WordPress installations running the Restrict Anonymous Access plugin version 1.2 or earlier
Deactivate and remove the plugin if a patched release is not yet available
Audit existing plugin data and remove any stored values containing HTML tags, script blocks, or event handler attributes
Rotate credentials and session tokens for administrator accounts that may have viewed compromised pages

Patch Information

No fixed version is listed in the enriched CVE data. The advisory covers versions up to and including 1.2. Consult the Patchstack XSS Vulnerability Report and the WordPress plugin repository for the latest release status before re-enabling the plugin.

Workarounds

Restrict plugin configuration access to trusted administrator accounts only
Deploy a Web Application Firewall (WAF) rule that blocks HTML and script metacharacters in POST requests to plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Remove contributor and low-privilege author accounts that are not actively needed

bash

# Example WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate restrict-anonymous-access
wp plugin delete restrict-anonymous-access

# Audit option table for suspicious stored values
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%javascript:%';"