CVE-2025-25084 Overview
CVE-2025-25084 is a stored cross-site scripting (XSS) vulnerability in the antrouss UniTimetable WordPress plugin. The flaw affects all versions from n/a through 1.1 and stems from improper neutralization of input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The vulnerability is classified under the scope-changed category, meaning the injected script can impact resources beyond the vulnerable component itself.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in other users' browsers, enabling session hijacking, credential theft, and privileged action abuse within WordPress administrative contexts.
Affected Products
- antrouss UniTimetable WordPress plugin, versions up to and including 1.1
- WordPress sites with the unitimetable plugin installed and activated
- Administrator and editor sessions on affected installations
Discovery Timeline
- 2025-03-03 - CVE-2025-25084 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-25084
Vulnerability Analysis
The UniTimetable plugin fails to sanitize user-supplied input before rendering it inside HTML output generated by the plugin. This is a classic stored XSS pattern where attacker-controlled data is written to the WordPress database and later reflected into pages without proper encoding. Because the payload is stored, every subsequent visitor to the affected page or admin screen executes the injected script under the origin of the WordPress site.
The scope-changed classification indicates that a successful attack can affect components other than the plugin itself, such as the WordPress administrative interface or authenticated user sessions. Exploitation requires user interaction, meaning a victim must load the page containing the malicious payload.
Root Cause
The root cause is missing or insufficient output encoding when plugin-managed timetable data is rendered into the DOM. WordPress provides sanitization functions such as esc_html(), esc_attr(), and wp_kses(), but the vulnerable code paths in UniTimetable up to version 1.1 do not consistently apply them to fields exposed to lower-privileged contributors.
Attack Vector
An attacker with authenticated access at a low privilege level submits crafted input containing HTML or JavaScript through a UniTimetable form or admin field. The malicious payload is stored persistently in the WordPress database. When an administrator, editor, or site visitor renders a page that includes the stored value, the browser parses the injected markup and executes the script. This can lead to cookie theft, forced administrative actions via CSRF, plugin or theme modification, and pivot to full site takeover.
No verified public proof-of-concept exploit code is available. See the Patchstack XSS Vulnerability Report for advisory details.
Detection Methods for CVE-2025-25084
Indicators of Compromise
- Unexpected <script>, <iframe>, or event handler attributes such as onerror= or onload= stored in wp_postmeta or plugin-specific database tables tied to UniTimetable
- Administrator sessions issuing unusual outbound requests immediately after loading a timetable page
- New administrative users, plugin installations, or theme file modifications occurring shortly after a low-privileged user submitted timetable content
Detection Strategies
- Query the WordPress database for UniTimetable entries containing HTML tags or JavaScript keywords such as <script, javascript:, onerror, or onload
- Monitor web server logs for POST requests to admin-ajax.php or plugin endpoints originating from low-privileged accounts followed by admin page views
- Deploy a Content Security Policy (CSP) in report-only mode to surface unauthorized inline script execution on pages rendered by the plugin
Monitoring Recommendations
- Enable WordPress audit logging to track content changes made by contributor and editor accounts
- Alert on privilege escalations, new user creation, or plugin activations that follow soon after timetable content edits
- Review browser console errors and CSP violation reports on pages that render UniTimetable output
How to Mitigate CVE-2025-25084
Immediate Actions Required
- Deactivate the UniTimetable plugin on any WordPress site running version 1.1 or earlier until a patched release is confirmed
- Audit all existing timetable records and remove any entries containing HTML tags, JavaScript, or suspicious attributes
- Rotate administrator credentials and invalidate active sessions if suspicious activity is detected
Patch Information
No fixed version is identified in the NVD record at the time of publication. The advisory states the issue affects UniTimetable from n/a through <= 1.1. Monitor the Patchstack XSS Vulnerability Report and the plugin's WordPress.org page for a vendor-issued update, and apply it immediately once available.
Workarounds
- Restrict UniTimetable editing capabilities to trusted administrators only by removing contributor or editor access to plugin endpoints
- Deploy a web application firewall (WAF) rule that blocks HTML and JavaScript payloads in plugin form submissions
- Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources on WordPress pages
# Configuration example: enforce a strict Content-Security-Policy header via Apache
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
