CVE-2025-25142 Overview
CVE-2025-25142 is a stored Cross-Site Scripting (XSS) vulnerability in The Jake Group's WP Less Compiler plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages.
The vulnerability affects WP Less Compiler versions up to and including 1.3.0. Exploitation requires user interaction but no authentication, and the scope is changed, meaning injected scripts can affect resources beyond the vulnerable component.
Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions performed in the context of authenticated WordPress users, including administrators.
Affected Products
- WP Less Compiler plugin for WordPress
- All versions from initial release through 1.3.0
- WordPress sites running The Jake Group wp-less-compiler
Discovery Timeline
- 2025-03-03 - CVE-2025-25142 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-25142
Vulnerability Analysis
The WP Less Compiler plugin fails to properly sanitize and escape input before rendering it in generated web pages. An attacker submits a crafted payload containing HTML or JavaScript through an input field accepted by the plugin. The plugin stores this payload and later returns it without encoding when the affected page is rendered.
Because the payload is persisted, every visitor to the affected page triggers script execution in their session context. The Common Weakness Enumeration classifies this as [CWE-79], Improper Neutralization of Input During Web Page Generation.
Root Cause
The root cause is missing output encoding and input validation on plugin-controlled data paths. WordPress provides escaping helpers such as esc_html(), esc_attr(), wp_kses(), and sanitization helpers like sanitize_text_field(). The vulnerable code paths in wp-less-compiler versions up to 1.3.0 do not consistently apply these primitives before echoing stored data to the page.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker injects a malicious script through a plugin input. When a victim, often an authenticated administrator viewing a settings or output page, loads the affected page, the stored script executes.
Consequences include theft of wp-admin session cookies, forced privileged actions through the WordPress REST API, creation of attacker-controlled admin accounts, and pivoting into content or file modifications. See the Patchstack Vulnerability Report for additional context.
Detection Methods for CVE-2025-25142
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in WordPress database tables associated with the WP Less Compiler plugin.
- Outbound requests from administrator browsers to unfamiliar domains shortly after viewing plugin-related admin pages.
- New WordPress administrator accounts or modified user roles without a corresponding audit trail.
- Unexpected modifications to theme or plugin files following admin sessions.
Detection Strategies
- Audit wp_options and plugin-specific tables for stored values containing HTML event handlers or <script> tags.
- Review web server access logs for POST requests to plugin endpoints carrying encoded script payloads.
- Monitor browser Content Security Policy (CSP) violation reports originating from /wp-admin/ pages.
- Inspect installed plugin versions across managed WordPress sites and flag any wp-less-compiler instance at version 1.3.0 or earlier.
Monitoring Recommendations
- Enable WordPress activity logging to track plugin setting changes and user role modifications.
- Forward web server, WordPress, and WAF logs to a centralized analytics platform for correlation.
- Alert on anomalous administrator session activity, including impossible-travel logins and off-hours configuration changes.
How to Mitigate CVE-2025-25142
Immediate Actions Required
- Identify all WordPress instances running wp-less-compiler version 1.3.0 or earlier and prioritize them for remediation.
- Deactivate and remove the WP Less Compiler plugin until a patched release is confirmed installed.
- Rotate WordPress administrator passwords and invalidate active sessions on affected sites.
- Review user accounts and recent content changes for signs of unauthorized modification.
Patch Information
At the time of publication, the Patchstack advisory indicates the vulnerability affects WP Less Compiler through version 1.3.0. Administrators should consult the Patchstack Vulnerability Report and the plugin repository for the latest fixed version, and apply it as soon as it becomes available.
Workarounds
- Remove the WP Less Compiler plugin from production sites until a vendor patch is verified.
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing script tags or HTML event handlers targeting plugin endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin interface.
- Restrict /wp-admin/ access by IP allowlist and require multi-factor authentication for administrator accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
