CVE-2025-24756 Overview
CVE-2025-24756 is a Cross-Site Request Forgery (CSRF) vulnerability in the mgplugin Roi Calculator plugin for WordPress that leads to Stored Cross-Site Scripting (XSS). The flaw affects all versions of the Roi Calculator plugin up through version 1.0. An attacker who tricks an authenticated administrator into clicking a crafted link or visiting a malicious page can persist arbitrary JavaScript into plugin-controlled content. The injected script then executes in the browser of any user viewing the affected page.
Critical Impact
Successful exploitation enables persistent JavaScript execution in administrator and visitor browsers, potentially leading to session theft, account takeover, and site defacement.
Affected Products
- mgplugin Roi Calculator WordPress plugin
- Versions from n/a through <= 1.0
- WordPress sites with the roi-calculator plugin installed and active
Discovery Timeline
- 2025-01-24 - CVE-2025-24756 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-24756
Vulnerability Analysis
The vulnerability chains two distinct weaknesses. The first is the absence of CSRF protection [CWE-352] on a state-changing administrative action in the Roi Calculator plugin. The second is insufficient output encoding or input sanitization on data accepted by that action, which allows JavaScript payloads to be stored and later rendered. The combined effect lets an unauthenticated remote attacker indirectly persist XSS payloads by abusing a logged-in administrator's session.
The attack requires user interaction, since the administrator must visit attacker-controlled content while authenticated to the target WordPress site. Once the payload is stored, it executes whenever the affected page is rendered, expanding the impact to any subsequent viewer.
Root Cause
The root cause is missing or improperly validated anti-CSRF tokens on plugin endpoints that update stored content. WordPress provides wp_nonce_field() and check_admin_referer() primitives, but the Roi Calculator plugin does not enforce them on the vulnerable handler. The handler also fails to sanitize submitted input using functions such as wp_kses_post() or sanitize_text_field() before persistence.
Attack Vector
The attack vector is network-based and requires victim interaction. An attacker hosts a malicious page containing an auto-submitting form or image tag that targets the plugin endpoint. When an authenticated WordPress administrator visits the page, the browser submits the forged request using the administrator's session cookies. The plugin stores the attacker's JavaScript payload, which then executes in any browser that loads the affected output.
The vulnerability mechanism is documented in the Patchstack Vulnerability Report. No public proof-of-concept exploit code is available at this time.
Detection Methods for CVE-2025-24756
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= strings stored in Roi Calculator plugin settings or output fields
- WordPress access logs showing POST requests to roi-calculator admin endpoints originating from external HTTP Referer headers
- Outbound browser requests from administrator sessions to unknown domains after visiting third-party sites
- New or modified WordPress administrator accounts following suspicious admin browsing activity
Detection Strategies
- Inspect the WordPress wp_options table and Roi Calculator-specific tables for HTML or JavaScript content where plain text is expected
- Monitor web server logs for POST requests to plugin handlers that lack a valid _wpnonce parameter
- Deploy a web application firewall rule to flag inbound requests containing common XSS payload patterns targeting roi-calculator paths
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface unexpected script execution on pages rendering Roi Calculator output
- Alert on administrator sessions that generate POST requests with off-site Referer values to /wp-admin/ endpoints
- Track plugin configuration changes through file integrity and database auditing tools
How to Mitigate CVE-2025-24756
Immediate Actions Required
- Deactivate and remove the Roi Calculator plugin until a patched version is confirmed available from the vendor
- Review all Roi Calculator stored content and remove any embedded HTML or JavaScript payloads
- Force a password reset and session invalidation for all WordPress administrator accounts
- Audit user accounts for unauthorized additions or privilege changes since the plugin was installed
Patch Information
No vendor-supplied patch is referenced in the available advisory data. The vulnerability affects all versions through 1.0. Site operators should monitor the Patchstack advisory for updates and apply any future plugin release that adds nonce verification and input sanitization.
Workarounds
- Remove the roi-calculator plugin directory from wp-content/plugins/ if a patch is not yet available
- Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer to reduce CSRF exposure
- Require administrators to use isolated browser profiles that do not visit untrusted sites while authenticated to WordPress
- Deploy a strict Content Security Policy that disallows inline scripts on affected pages
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate roi-calculator
wp plugin delete roi-calculator
# Verify removal
wp plugin list --status=active | grep -i roi-calculator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
