CVE-2025-25160 Overview
CVE-2025-25160 is a Cross-Site Request Forgery (CSRF) vulnerability in the Mark Barnes Style Tweaker WordPress plugin. The flaw enables an attacker to trigger a Stored Cross-Site Scripting (XSS) payload by inducing an authenticated administrator to submit a crafted request. The vulnerability affects all versions of Style Tweaker up to and including 0.11. The issue is tracked under CWE-352 and was published to the National Vulnerability Database (NVD) on February 7, 2025.
Critical Impact
A successful attack stores attacker-controlled JavaScript in the plugin's settings, executing in the context of any user who loads the affected admin or front-end page.
Affected Products
- Mark Barnes Style Tweaker plugin for WordPress
- All versions from n/a through 0.11
- WordPress sites with Style Tweaker installed and activated
Discovery Timeline
- 2025-02-07 - CVE-2025-25160 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-25160
Vulnerability Analysis
The Style Tweaker plugin exposes a settings handler that accepts style customization input from administrators. The handler does not validate a CSRF token (nonce) before processing state-changing requests. An attacker who lures an authenticated administrator to a malicious page can submit a forged POST request that writes attacker-controlled content into plugin options.
Because the plugin does not sanitize or encode the stored input before rendering it in the WordPress admin interface or on the front end, the payload executes as JavaScript. This converts a client-side CSRF into a Stored XSS condition. The chained impact allows account takeover, session theft, or arbitrary administrative actions performed under the victim's session.
Root Cause
The root cause is missing CSRF protection [CWE-352] on the plugin's settings save routine. WordPress provides wp_nonce_field() and check_admin_referer() primitives for this purpose, but the vulnerable code path omits nonce verification. Insufficient output encoding on the stored value compounds the issue, permitting the injected script to reach the DOM.
Attack Vector
Exploitation requires user interaction from a logged-in administrator. The attacker hosts a page containing an auto-submitting HTML form or fetch() request that targets the plugin's settings endpoint. When the administrator visits the attacker's page while authenticated to WordPress, the browser transmits session cookies and the malicious payload is stored. Subsequent page loads execute the injected script in the victim's browser session.
Refer to the Patchstack WordPress Vulnerability Notice for additional technical detail.
Detection Methods for CVE-2025-25160
Indicators of Compromise
- Unexpected <script>, <iframe>, or event-handler attributes stored in Style Tweaker plugin options within the wp_options table
- WordPress admin sessions initiating outbound requests to unknown domains after visiting external links
- New or modified administrator accounts created without corresponding audit log entries
- POST requests to Style Tweaker settings endpoints originating from off-site Referer headers
Detection Strategies
- Review the wp_options table for Style Tweaker keys containing HTML or JavaScript tokens such as <script, onerror=, or javascript:
- Inspect WordPress access logs for POST requests to wp-admin/options-general.php or plugin-specific endpoints with cross-origin Referer values
- Deploy a Web Application Firewall (WAF) rule to alert on requests to the plugin settings URL lacking a valid WordPress nonce parameter
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes and administrator authentication events
- Monitor browser Content Security Policy (CSP) violation reports for inline script execution on admin pages
- Alert on administrative actions occurring within seconds of an admin session visiting external URLs
How to Mitigate CVE-2025-25160
Immediate Actions Required
- Deactivate and remove the Style Tweaker plugin until a patched release becomes available
- Audit the wp_options table and remove any injected HTML or JavaScript stored by the plugin
- Force password resets and session invalidation for all WordPress administrator accounts
- Review recently created users, roles, and scheduled tasks for unauthorized modifications
Patch Information
No vendor patch is listed in the enriched data. The vulnerability affects Style Tweaker versions through 0.11. Monitor the Patchstack advisory and the plugin's WordPress.org page for a fixed version.
Workarounds
- Uninstall Style Tweaker and replace its functionality with an actively maintained alternative
- Restrict wp-admin access by IP allowlist to reduce exposure of authenticated administrators to CSRF payloads
- Deploy a WAF rule that blocks POST requests to Style Tweaker endpoints missing a valid _wpnonce parameter
- Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin interface
# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate style-tweaker
wp plugin uninstall style-tweaker
# Search wp_options for stored XSS payloads
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%style_tweaker%' AND option_value LIKE '%<script%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
