CVE-2025-25157: WP Church Center XSS Vulnerability

CVE-2025-25157 Overview

CVE-2025-25157 is a reflected Cross-Site Scripting (XSS) vulnerability in the WP Church Center WordPress plugin developed by wpchurchteam. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All versions of WP Church Center up to and including 1.3.3 are affected. Attackers can craft malicious links that, when clicked by an authenticated or unauthenticated user, execute arbitrary JavaScript in the victim's browser within the context of the vulnerable site. The vulnerability requires user interaction and changes the security scope, allowing attackers to impact resources beyond the vulnerable component.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and arbitrary actions performed on behalf of the targeted user, including site administrators.

Affected Products

WP Church Center plugin for WordPress, versions up to and including 1.3.3
WordPress sites running the vulnerable wp-church-center plugin
Any deployment where untrusted users can deliver crafted URLs to plugin users

Discovery Timeline

2025-03-03 - CVE-2025-25157 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25157

Vulnerability Analysis

The vulnerability is a reflected XSS issue affecting the WP Church Center plugin through version 1.3.3. The plugin accepts user-controlled input via HTTP request parameters and reflects that input back into rendered HTML responses without proper output encoding or sanitization. Because the attack vector is network-based and requires no privileges, any remote attacker can craft an exploit payload. The scope change indicates that injected scripts execute in a context capable of affecting resources beyond the plugin itself, such as the surrounding WordPress administrative session.

The EPSS probability for this CVE is 0.232% with a percentile rank of 45.9, indicating modest near-term exploitation likelihood relative to other published CVEs. No public proof-of-concept exploit code has been associated with the entry, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under [CWE-79]. The plugin fails to apply context-appropriate output encoding when echoing request parameters back into HTML responses. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for safe output, but the affected code paths in wp-church-center do not use them on tainted data before reflection.

Attack Vector

An attacker constructs a URL pointing to a vulnerable endpoint of the WP Church Center plugin and embeds JavaScript payloads within a reflected parameter. The attacker delivers the URL through phishing email, social media, or a malicious third-party site. When a victim clicks the link, the server reflects the payload into the response and the browser executes the injected script in the WordPress site's origin. The script can then read cookies accessible to JavaScript, manipulate the DOM, exfiltrate CSRF tokens, or invoke privileged WordPress REST API calls on behalf of authenticated users. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-25157

Indicators of Compromise

HTTP access logs containing requests to WP Church Center endpoints with parameter values that include script tags, event handlers, or javascript: URIs
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin URLs
Newly created WordPress administrator accounts or modified user roles without a corresponding legitimate workflow
Referrer headers pointing to external sites that precede suspicious plugin requests

Detection Strategies

Inspect web server and WAF logs for query strings containing encoded payloads such as %3Cscript%3E, onerror=, onload=, or javascript: targeting wp-church-center paths
Deploy Content Security Policy (CSP) violation reporting to surface injected inline scripts blocked at the browser
Run authenticated and unauthenticated XSS scanners against wp-church-center endpoints to confirm reflection of injected payloads

Monitoring Recommendations

Alert on anomalous administrator session activity such as plugin installs, theme edits, or user creation following a click on an external link
Monitor WordPress audit logs for changes to options, users, and plugin settings correlated with reflected XSS request patterns
Track plugin version inventory across WordPress fleets to identify hosts still running wp-church-center<= 1.3.3

How to Mitigate CVE-2025-25157

Immediate Actions Required

Update WP Church Center to a version newer than 1.3.3 once a vendor-released patched version is available
If no fixed version is available, deactivate and remove the wp-church-center plugin from affected WordPress sites
Force a password reset and session invalidation for WordPress administrators who may have clicked suspicious links
Review WordPress user accounts, scheduled tasks, and plugin files for unauthorized changes

Patch Information

Consult the Patchstack Vulnerability Advisory for the current patch status and the latest plugin release information from wpchurchteam. The advisory identifies all versions through 1.3.3 as vulnerable.

Workarounds

Deploy a Web Application Firewall rule that blocks requests to wp-church-center endpoints containing common XSS payload signatures
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict access to the WordPress admin interface by IP allowlist to reduce the chance of administrator-targeted exploitation
Educate site administrators about phishing links that target WordPress sessions

bash

# Example WAF rule pattern (ModSecurity) to block reflected XSS attempts
SecRule REQUEST_URI "@contains /wp-church-center" \
    "chain,deny,status:403,id:1002501,msg:'Potential CVE-2025-25157 XSS attempt'"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:urlDecodeUni,t:htmlEntityDecode"