CVE-2025-25128 Overview
CVE-2025-25128 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the orlandolac Facilita Form Tracker WordPress plugin. The flaw affects all versions up to and including 1.0. Attackers can chain the CSRF weakness with insufficient output encoding to achieve Stored Cross-Site Scripting (XSS). Successful exploitation requires an authenticated administrator to visit an attacker-controlled page while logged into WordPress. The injected script then persists in the database and executes for subsequent visitors.
Critical Impact
An attacker who tricks an authenticated administrator into visiting a malicious page can inject persistent JavaScript into the WordPress site, leading to session theft, content tampering, and further compromise of site visitors.
Affected Products
- orlandolac Facilita Form Tracker plugin for WordPress
- All versions from n/a through 1.0
- WordPress installations with the facilita-form-tracker plugin enabled
Discovery Timeline
- 2025-02-07 - CVE-2025-25128 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-25128
Vulnerability Analysis
The vulnerability combines two weaknesses in the Facilita Form Tracker plugin. First, plugin endpoints that modify stored data lack CSRF protection. They do not validate WordPress nonces or enforce a same-origin check. Second, the data accepted by these endpoints is later rendered in the browser without proper output encoding. This combination converts a request forgery primitive into a stored XSS payload that affects every user who loads the affected page.
The required user interaction reflects the need for an authenticated user to navigate to an attacker-controlled page. Because the attack abuses an authenticated session, no credentials are required by the attacker. The scope change indicates that injected scripts execute in the browser context of any visitor, not just the privileged user who triggered the original request.
Root Cause
The root cause is missing CSRF token validation on plugin write operations combined with absent sanitization of stored input. WordPress provides wp_nonce_field() and check_admin_referer() to mitigate CSRF, and esc_html(), esc_attr(), and wp_kses() for output encoding. Facilita Form Tracker version 1.0 does not consistently apply these controls on the affected handlers.
Attack Vector
An attacker hosts a page containing a hidden form or fetch() call that targets the plugin's vulnerable endpoint on the victim's WordPress site. When an authenticated administrator visits the page, the browser sends the forged request along with valid session cookies. The plugin processes the request and stores attacker-controlled markup. The payload then executes whenever the affected view is rendered, completing the CSRF-to-Stored-XSS chain.
The vulnerability mechanism is documented in the Patchstack Vulnerability Report.
Detection Methods for CVE-2025-25128
Indicators of Compromise
- Unexpected <script> tags or HTML event handlers stored in Facilita Form Tracker database records or wp_options entries created by the plugin.
- Outbound requests from administrator browsers to unknown domains shortly after loading wp-admin pages.
- Unauthorized changes to plugin-managed content without corresponding entries in administrator activity logs.
Detection Strategies
- Audit WordPress database tables associated with facilita-form-tracker for HTML tags, JavaScript URI schemes, or encoded payloads such as <script>.
- Inspect web server access logs for POST requests to plugin endpoints lacking a referer header from the same origin.
- Review browser console errors or Content Security Policy (CSP) violation reports from administrative sessions.
Monitoring Recommendations
- Enable WordPress activity logging to record plugin configuration changes and admin-side write operations.
- Forward web server logs to a centralized analytics platform and alert on plugin POST requests with external or null referer headers.
- Monitor for new or unexpected administrative accounts and modified user roles following CSRF attempts.
How to Mitigate CVE-2025-25128
Immediate Actions Required
- Deactivate and remove the Facilita Form Tracker plugin until a patched version is published.
- Review WordPress administrator accounts, force a password reset, and invalidate active sessions.
- Inspect plugin-managed content and the wp_options table for injected script payloads and remove them.
Patch Information
No fixed version is listed in the available advisory. The vulnerability affects Facilita Form Tracker up to and including version 1.0. Refer to the Patchstack Vulnerability Report for vendor updates. Until a patch is available, removal is the recommended action.
Workarounds
- Restrict access to /wp-admin/ by IP allowlisting at the web server or WAF layer to limit CSRF reach.
- Deploy a WordPress-aware Web Application Firewall with rules that block requests to plugin endpoints missing valid nonces.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce stored XSS impact.
- Train administrators to log out of WordPress before browsing untrusted sites and use a dedicated browser profile for site administration.
# Example: disable the plugin via WP-CLI until a fix is released
wp plugin deactivate facilita-form-tracker
wp plugin delete facilita-form-tracker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
