CVE-2025-25105: Pop Up Plugin Stored XSS Vulnerability

CVE-2025-25105 Overview

CVE-2025-25105 is a stored Cross-Site Scripting (XSS) vulnerability in the coffeestudios Pop Up (popup-seo-optimized) WordPress plugin. The flaw affects all versions up to and including 0.1. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79].

An authenticated attacker with high privileges can inject persistent JavaScript payloads. The payloads execute in the browser context of any user viewing the affected page. Exploitation requires user interaction and produces a scope change, allowing script execution beyond the plugin's original security boundary.

Critical Impact

Stored XSS enables session hijacking, credential theft, and unauthorized administrative actions against WordPress site users who load the injected content.

Affected Products

• coffeestudios Pop Up (popup-seo-optimized) WordPress plugin — versions up to and including 0.1

Discovery Timeline

• 2025-02-07 - CVE-2025-25105 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25105

Vulnerability Analysis

The vulnerability exists in the Pop Up plugin's handling of input rendered into WordPress-generated pages. The plugin fails to sanitize or escape user-supplied data before writing it into HTML output. Attackers store crafted payloads that persist in the site's database and execute whenever a victim loads the affected content.

Because the stored payload runs in the victim's browser under the site's origin, attackers can execute arbitrary JavaScript against authenticated sessions. This behavior maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing output encoding and input sanitization within the plugin's data-handling routines. WordPress provides sanitization helpers such as sanitize_text_field(), wp_kses_post(), and esc_html() that were not applied to the affected inputs. Data flows from an authenticated request into persistent storage, then to page rendering without contextual escaping.

Attack Vector

Exploitation is network-based and requires an authenticated actor with high-level privileges within WordPress. The attacker submits a crafted payload through the plugin's administrative interface. When another user, typically an administrator or site visitor, loads the page containing the stored payload, the injected script executes in their browser context.

The scope change reflected in the CVSS vector indicates the injected script escapes the plugin boundary and can affect other WordPress components rendered on the same origin. See the Patchstack Security Advisory for additional technical detail.

Detection Methods for CVE-2025-25105

Indicators of Compromise

• Unexpected <script>, <iframe>, or event-handler attributes (onerror=, onload=) stored in Pop Up plugin database entries within wp_options or plugin-specific tables.
• Outbound requests from administrator browsers to attacker-controlled domains shortly after loading plugin-managed pages.
• New or modified WordPress administrator accounts created outside of authorized change windows.

Detection Strategies

• Audit plugin-stored content in the WordPress database for HTML tags and JavaScript event handlers using SQL pattern searches.
• Deploy a web application firewall (WAF) rule set that inspects POST parameters submitted to popup-seo-optimized admin endpoints.
• Enable Content Security Policy (CSP) reporting to capture inline script execution violations originating from plugin-rendered pages.

Monitoring Recommendations

• Monitor WordPress admin-ajax.php and plugin administrative endpoints for anomalous payload sizes or HTML-encoded characters.
• Log and review privileged user activity, particularly configuration changes to the Pop Up plugin, through WordPress audit logging.
• Correlate browser-side CSP violation reports with server-side plugin configuration changes to identify active exploitation.

How to Mitigate CVE-2025-25105

Immediate Actions Required

• Deactivate and remove the popup-seo-optimized plugin until a patched version is available, as no fixed release is currently listed.
• Review all existing plugin configuration entries in the WordPress database and remove any stored HTML or JavaScript payloads.
• Rotate credentials and force re-authentication for any administrator accounts that accessed the plugin interface.

Patch Information

No vendor patch is currently referenced in the NVD entry or the Patchstack Security Advisory. All versions through 0.1 remain affected. Administrators should track the plugin repository for a fixed release or migrate to an actively maintained alternative.

Workarounds

• Restrict administrative access to WordPress through IP allowlisting and enforce multi-factor authentication for all privileged accounts.
• Deploy a Content Security Policy that blocks inline scripts and unauthorized external script sources.
• Apply virtual patching via a WAF to filter script tags and event-handler attributes submitted to plugin endpoints.

# Example CSP header to block inline scripts on WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"