CVE-2025-25138: On Page SEO Plugin CSRF Vulnerability

CVE-2025-25138 Overview

CVE-2025-25138 is a Cross-Site Request Forgery (CSRF) vulnerability in the Rishi On Page SEO + Whatsapp Chat Button WordPress plugin (formerly known as the OPS plugin, distributed under the ops-robots-txt slug). The flaw chains into a Stored Cross-Site Scripting (XSS) condition, allowing attackers to persist malicious JavaScript in plugin-controlled content. The issue affects all plugin versions up to and including 2.0.0. Exploitation requires a logged-in privileged user to load attacker-controlled content, after which the injected payload executes in the context of any visitor or administrator viewing the affected page. The vulnerability is tracked under CWE-352.

Critical Impact

An unauthenticated attacker can trick a logged-in administrator into submitting a forged request that injects persistent JavaScript into the site, leading to session theft, account takeover, or further site compromise.

Affected Products

• Rishi On Page SEO + Whatsapp Chat Button (formerly OPS Plugin) — versions up to and including 2.0.0
• WordPress installations using the ops-robots-txt plugin slug
• Any site administrator session with privileges to manage plugin settings

Discovery Timeline

• 2025-02-07 - CVE-2025-25138 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25138

Vulnerability Analysis

The plugin exposes administrative functions that update settings related to robots.txt content and on-page SEO metadata without enforcing anti-CSRF protections. State-changing endpoints accept POST requests without validating a WordPress nonce or verifying request origin. Because the same endpoints fail to sanitize or escape the submitted values before storing them, the missing CSRF check is amplified into a Stored XSS primitive.

An attacker hosts a page containing a forged form or fetch request targeting the vulnerable plugin endpoint. When an authenticated administrator visits the malicious page, the browser submits the request with valid session cookies. The plugin accepts the unauthenticated-from-the-attacker but authenticated-from-WordPress request and writes attacker-controlled markup, including <script> tags, into plugin storage. Subsequent page renders execute the payload in every visitor's browser.

Root Cause

The root cause is the absence of nonce verification (wp_verify_nonce or check_admin_referer) on settings handlers, combined with insufficient output encoding on stored values. Both controls must fail for the chain to succeed, and in this plugin both are missing on the affected ops-robots-txt related routes.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker must induce a privileged WordPress user to visit an external page or click a crafted link while authenticated to the target site. No attacker credentials on the target are required.

The vulnerability is described in prose only; no public proof-of-concept has been published. See the Patchstack WordPress Vulnerability Advisory for technical details.

Detection Methods for CVE-2025-25138

Indicators of Compromise

• Unexpected <script>, <iframe>, or event-handler attributes appearing in plugin-managed settings such as robots.txt output, SEO metadata fields, or chat button configuration.
• WordPress audit logs showing settings updates to ops-robots-txt options without a corresponding administrator session in the admin UI.
• Outbound requests from visitor browsers to unfamiliar domains shortly after loading pages rendered by the plugin.

Detection Strategies

• Inspect the wp_options table for plugin-prefixed entries containing HTML or JavaScript that should not appear in SEO or robots.txt fields.
• Review web server access logs for POST requests to plugin admin-ajax or settings handlers originating from Referer values outside the site's own domain.
• Hunt for administrator browser sessions that loaded external pages immediately before plugin option modifications.

Monitoring Recommendations

• Enable file and database integrity monitoring on WordPress option tables and plugin directories.
• Forward WordPress and web server logs to a SIEM and alert on settings changes lacking matching admin console activity.
• Deploy a Web Application Firewall (WAF) rule to flag cross-origin POSTs to WordPress admin endpoints missing a valid _wpnonce parameter.

How to Mitigate CVE-2025-25138

Immediate Actions Required

• Update the Rishi On Page SEO + Whatsapp Chat Button plugin to a version later than 2.0.0 as soon as a patched release is available.
• Audit plugin settings for injected scripts or unexpected HTML and remove any malicious content from stored options.
• Rotate administrator passwords and invalidate active sessions if Stored XSS execution is suspected.

Patch Information

The vendor advisory is tracked through Patchstack. Refer to the Patchstack advisory for ops-robots-txt for the latest fixed version and remediation guidance. Sites unable to upgrade should consider deactivating the plugin until a patch is verified.

Workarounds

• Deactivate the ops-robots-txt plugin until a fixed version is installed and validated.
• Restrict WordPress administrator browsing to dedicated, hardened workstations that do not visit untrusted sites during privileged sessions.
• Apply a virtual patch via WAF to require a valid WordPress nonce on POST requests targeting plugin settings endpoints.

# Example WAF rule pseudocode: block cross-origin POSTs to plugin endpoints lacking a nonce
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1025138,phase:2,deny,status:403,msg:'CVE-2025-25138 CSRF guard'"
  SecRule REQUEST_URI "@rx /wp-admin/(admin-post|admin-ajax)\.php" "chain"
    SecRule &ARGS:_wpnonce "@eq 0"