CVE-2025-25096: RSS in Page Stored XSS Vulnerability

CVE-2025-25096 Overview

CVE-2025-25096 is a stored Cross-Site Scripting (XSS) vulnerability in the RSS in Page WordPress plugin by titusbicknell. The flaw affects all plugin versions up to and including 2.9.1. It results from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the application and executes in the browsers of users who view the affected page.

Critical Impact
Attackers with low-privileged accounts can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, unauthorized actions, and content manipulation across the affected WordPress site.

Affected Products

titusbicknell RSS in Page WordPress plugin
Versions from n/a through 2.9.1
WordPress installations using the vulnerable plugin

Discovery Timeline

2025-02-07 - CVE-2025-25096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25096

Vulnerability Analysis

The RSS in Page plugin fails to sanitize and escape input before storing it and rendering it back to the page. This is a stored (persistent) XSS: the malicious payload is saved server-side and served to every subsequent visitor who loads the affected view. Because the payload executes in the origin of the WordPress site, it inherits the browser session of the victim.

Successful exploitation requires an authenticated user with contributor-level or similar low privileges to submit the payload, and requires a victim to load the affected page. Impact spans confidentiality, integrity, and availability at limited levels, and the scope changes because injected script runs in a different security context than the vulnerable component.

Root Cause

The root cause is missing output encoding and input validation in code paths that handle plugin input rendered into the WordPress front end. WordPress provides sanitization helpers such as esc_html(), esc_attr(), and wp_kses(), but the plugin does not apply them consistently to fields incorporated into generated HTML, allowing <script> tags and event-handler attributes to survive into the DOM.

Attack Vector

The attack proceeds over the network. An authenticated attacker submits a crafted payload into a plugin-controlled field. The payload is stored in the WordPress database. When an administrator or visitor loads a page rendered by the plugin, the browser executes the injected script under the site's origin, enabling cookie theft, forced administrative actions via CSRF-style requests, and defacement.

Technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-25096

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or on* event handlers stored in WordPress post, option, or plugin-specific database tables.
Outbound requests from browsers of authenticated administrators to unfamiliar domains shortly after visiting plugin-rendered pages.
New or modified administrator accounts created without corresponding audit-log activity.

Detection Strategies

Audit database rows associated with the RSS in Page plugin for HTML tags and script content in fields that should hold plain text or URLs.
Deploy a web application firewall (WAF) rule set that inspects POST bodies for XSS payload patterns targeting WordPress plugin endpoints.
Enable and review WordPress activity logs for content edits performed by low-privilege accounts.

Monitoring Recommendations

Monitor endpoints that render plugin content for unexpected script execution using Content Security Policy (CSP) violation reports.
Track browser telemetry from administrator workstations for anomalous script activity or credential-theft indicators.
Alert on new low-privilege account registrations followed by content submissions to plugin-managed fields.

How to Mitigate CVE-2025-25096

Immediate Actions Required

Disable and deactivate the RSS in Page plugin on all WordPress sites until a patched release is verified as installed.
Restrict content-submission privileges to trusted users and review recent submissions from contributor and author roles.
Rotate WordPress administrator sessions and cookies to invalidate any credentials potentially exposed to injected scripts.

Patch Information

At the time of publication, no fixed version beyond 2.9.1 is referenced in the enriched CVE data. Consult the Patchstack Vulnerability Report for the latest remediation status and apply any released update from the plugin author immediately.

Workarounds

Remove the plugin from production sites and replace its functionality with a maintained RSS-embedding alternative.
Enforce a strict Content Security Policy that disallows inline scripts (unsafe-inline) and restricts script sources to trusted origins.
Apply WAF virtual patching rules that block XSS payload signatures targeting the plugin's input handlers.

bash

# Content Security Policy header example for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;