CVE-2025-25092: All Push Notification for WP XSS Flaw

CVE-2025-25092 Overview

CVE-2025-25092 is a reflected Cross-Site Scripting (XSS) vulnerability in the All push notification for WP WordPress plugin developed by gtlwpdev. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. All plugin versions up to and including 1.5.3 are affected. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session under the context of the vulnerable WordPress site.

Critical Impact

Successful exploitation allows attackers to execute JavaScript in a victim's browser, enabling session theft, credential harvesting, and unauthorized actions within the WordPress site.

Affected Products

• gtlwpdev All push notification for WP plugin (all-push-notification)
• Versions from n/a through <= 1.5.3
• WordPress sites with the affected plugin installed and active

Discovery Timeline

• 2025-03-03 - CVE-2025-25092 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25092

Vulnerability Analysis

The vulnerability is a reflected XSS issue classified under [CWE-79]. User-supplied input is reflected into the HTTP response without proper output encoding or sanitization. The attack requires user interaction, typically a victim clicking a crafted link. Because the scope is changed during exploitation, the injected script can affect resources beyond the vulnerable component, including the authenticated user's session context.

The Exploit Prediction Scoring System (EPSS) places this issue at a probability of 0.232%, indicating that observed exploitation activity remains low at present. No public proof-of-concept exploit and no CISA Known Exploited Vulnerabilities (KEV) listing are associated with this CVE at the time of writing.

Root Cause

The plugin fails to apply output encoding or input sanitization when rendering user-controllable data into the page response. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() for safe output handling. The affected plugin does not consistently route reflected input through these escaping routines, allowing HTML and JavaScript payloads to be rendered verbatim in the response.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL containing a malicious payload in a vulnerable parameter handled by the plugin. The victim must click the link or visit a page that triggers the request. Once the payload reflects into the response, the browser executes the attacker's JavaScript within the origin of the vulnerable WordPress site. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-25092

Indicators of Compromise

• HTTP requests to plugin endpoints containing encoded <script>, onerror=, or javascript: payloads in query parameters
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin pages
• WordPress access logs showing crafted URLs targeting all-push-notification plugin routes with abnormal parameter content

Detection Strategies

• Inspect web server and WAF logs for request parameters containing HTML tag characters (<, >, ") and common XSS payload signatures targeting plugin endpoints
• Deploy WordPress security plugins that scan installed plugin versions and flag all-push-notification versions <= 1.5.3
• Use content security policy (CSP) violation reports to identify inline script execution from untrusted contexts

Monitoring Recommendations

• Monitor WordPress administrator session activity for anomalous actions following link clicks from external referrers
• Alert on requests to the affected plugin's endpoints containing URL-encoded script tags or event handler attributes
• Track plugin inventory across managed WordPress sites and correlate against known-vulnerable version ranges

How to Mitigate CVE-2025-25092

Immediate Actions Required

• Identify all WordPress installations running the All push notification for WP plugin at version 1.5.3 or earlier
• Deactivate and remove the plugin until a patched version is confirmed available from the vendor
• Force password resets for WordPress administrators who may have interacted with crafted links targeting the plugin

Patch Information

At the time of publication, the Patchstack Vulnerability Report lists the issue as affecting versions up to and including 1.5.3. Site operators should consult the plugin's official page for the latest release and apply any vendor-supplied update that addresses CVE-2025-25092.

Workarounds

• Deploy a web application firewall (WAF) rule that blocks requests containing HTML tag characters or event handler patterns directed at the plugin's endpoints
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Restrict access to the WordPress site using authentication or IP allowlists while a patch is pending

# Example WAF rule (ModSecurity) blocking common reflected XSS payloads
SecRule REQUEST_URI "@contains all-push-notification" \
    "chain,deny,status:403,id:1002501,msg:'Possible XSS targeting CVE-2025-25092'"
SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|onload=)" "t:none,t:urlDecodeUni"