CVE-2025-24675: WP Visitor Statistics Stored XSS Vulnerability

CVE-2025-24675 Overview

CVE-2025-24675 is a stored cross-site scripting (XSS) vulnerability in the WP Visitor Statistics (Real Time Traffic) WordPress plugin, also known as wp-stats-manager, developed by osama.esh. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Attackers with low-privileged access can inject persistent JavaScript payloads that execute in the browser context of visitors and administrators who view the affected pages. The vulnerability affects all plugin versions up to and including 7.2.

Critical Impact
Authenticated attackers can store malicious scripts that execute against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

WP Visitor Statistics (Real Time Traffic) plugin (wp-stats-manager) versions up to and including 7.2
WordPress sites with the vulnerable plugin activated
Any environment where low-privileged users can submit input processed by the plugin

Discovery Timeline

2025-01-24 - CVE-2025-24675 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24675

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the wp-stats-manager plugin. The plugin fails to sanitize and escape user-controlled input before rendering it back into HTML output. As a result, malicious payloads persist in the WordPress database and execute when other users load the affected pages.

The issue has a scope change component, meaning injected scripts execute in a security context beyond the vulnerable component. This typically means administrator sessions viewing statistics dashboards can be compromised by content submitted by lower-privileged users or unauthenticated visitors whose data is logged by the plugin.

User interaction is required to trigger the payload. An administrator or privileged user must load the page containing the stored script for execution to occur.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to values rendered into administrative or public views. Input captured by the statistics tracker is stored verbatim and later reflected into HTML contexts without contextual encoding.

Attack Vector

An attacker submits crafted input containing JavaScript through a request handled by the plugin. The plugin persists the payload in the database. When a privileged user later opens the plugin's statistics interface, the stored payload executes with that user's privileges. Consequences include cookie theft, session hijacking, forced administrative actions via CSRF chaining, and injection of additional persistence mechanisms into the WordPress site.

The vulnerability is described in the Patchstack XSS Vulnerability Report.

Detection Methods for CVE-2025-24675

Indicators of Compromise

Unexpected <script>, <iframe>, onerror=, or onload= strings stored in wp-stats-manager database tables
WordPress administrator sessions making unexpected AJAX or REST API calls shortly after loading plugin dashboards
New administrative accounts or modified user roles created without corresponding legitimate activity
Outbound requests from administrator browsers to unknown domains after visiting the statistics interface

Detection Strategies

Query plugin database tables for HTML tags, JavaScript event handlers, and javascript: URI schemes in visitor-supplied fields
Review WordPress access logs for requests containing encoded XSS payloads targeting plugin endpoints
Compare installed plugin versions against the fixed release across all managed WordPress sites
Inspect the WordPress usermeta and options tables for unauthorized modifications following administrator page loads

Monitoring Recommendations

Enable a web application firewall (WAF) with XSS signature detection in front of WordPress hosts
Log and alert on administrator account creation, role changes, and plugin installations
Monitor browser telemetry from privileged workstations for anomalous script execution when visiting admin pages
Ingest WordPress and web server logs into a central data lake for correlation and threat hunting

How to Mitigate CVE-2025-24675

Immediate Actions Required

Deactivate the wp-stats-manager plugin on all WordPress installations until an updated version is applied
Audit stored plugin data for injected scripts and purge malicious entries
Rotate WordPress administrator credentials and invalidate active sessions for privileged users
Review the site for unauthorized administrator accounts, modified themes, and injected files

Patch Information

No fixed version is listed in the CVE record at the time of publication. Users should consult the Patchstack advisory and the plugin's WordPress.org page for updates. Apply any release higher than 7.2 that explicitly addresses this XSS issue.

Workarounds

Restrict access to the plugin's administrative interface using IP allowlists or WordPress role-based restrictions
Deploy a WAF rule set that blocks HTML and JavaScript payloads in requests to wp-stats-manager endpoints
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WordPress admin pages
Remove low-privileged accounts that are not strictly required to reduce the attacker pool

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-stats-manager
wp plugin status wp-stats-manager