CVE-2025-25169: Authors Autocomplete Meta Box XSS Flaw

CVE-2025-25169 Overview

CVE-2025-25169 is a reflected cross-site scripting (XSS) vulnerability in the Rachel Cherry Authors Autocomplete Meta Box plugin for WordPress. The flaw affects all plugin versions up to and including 1.2. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in a victim's browser. The vulnerability is classified under [CWE-79] and requires user interaction to exploit. Successful exploitation can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated WordPress users.

Critical Impact

Attackers can execute arbitrary JavaScript in victim browsers by tricking authenticated users into clicking crafted links, potentially leading to administrative account takeover.

Affected Products

• Rachel Cherry Authors Autocomplete Meta Box plugin for WordPress
• All versions from n/a through 1.2
• WordPress sites with the plugin enabled

Discovery Timeline

• 2025-03-03 - CVE-2025-25169 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25169

Vulnerability Analysis

The Authors Autocomplete Meta Box plugin contains a reflected XSS flaw resulting from improper input neutralization during web page generation. When the plugin processes user-supplied parameters, it echoes input back into the rendered HTML response without sufficient sanitization or output encoding. An attacker crafts a malicious URL containing JavaScript payloads as parameter values. When an authenticated WordPress user clicks the link, the payload reflects into the page and executes within the user's browser session. The vulnerability has a changed scope, meaning the injected script can affect resources beyond the vulnerable component itself. The EPSS score is 0.346% with a percentile of 57.27, indicating moderate exploitation likelihood relative to other published CVEs.

Root Cause

The root cause is missing or insufficient output encoding when the plugin reflects request parameters into HTML responses. The plugin does not apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() to user-controlled data before rendering it. This omission allows raw HTML and JavaScript markup to be interpreted by the browser as executable content rather than displayed as text.

Attack Vector

Exploitation requires an attacker to craft a malicious URL containing the XSS payload and trick a victim with WordPress access into clicking it. The attack is conducted over the network and requires user interaction. No prior authentication is needed by the attacker. Once the victim loads the crafted URL, the embedded JavaScript executes in their browser context, where it can steal cookies, perform actions as the user, or exfiltrate sensitive data. The Patchstack advisory provides additional technical detail. See the Patchstack Vulnerability Report for further information.

Detection Methods for CVE-2025-25169

Indicators of Compromise

• HTTP requests to WordPress admin endpoints containing URL-encoded <script> tags, javascript: URIs, or event handler attributes such as onerror= and onload=.
• Unexpected outbound connections from administrator browsers to attacker-controlled domains shortly after clicking inbound links.
• WordPress audit logs showing unexpected administrative changes performed by legitimate user accounts.

Detection Strategies

• Inspect web server access logs for query strings containing HTML or JavaScript metacharacters targeting plugin endpoints.
• Deploy a web application firewall (WAF) with rules tuned to detect reflected XSS payloads in WordPress plugin parameters.
• Monitor referrer headers and click patterns to identify suspicious inbound links pointing to plugin-specific URLs.

Monitoring Recommendations

• Enable WordPress activity logging to track administrator session activity and configuration changes.
• Correlate browser-side Content Security Policy (CSP) violation reports with server-side logs to identify XSS attempts.
• Alert on plugin-related URL patterns appearing in phishing or threat intelligence feeds.

How to Mitigate CVE-2025-25169

Immediate Actions Required

• Disable or remove the Authors Autocomplete Meta Box plugin from WordPress installations until a patched version is available.
• Audit administrator and editor accounts for unexpected activity or session anomalies.
• Force password resets and invalidate active sessions for privileged WordPress users.

Patch Information

At the time of publication, no patched version is documented in the available references. The vulnerability affects all versions through 1.2. Site operators should consult the Patchstack Vulnerability Report for updates and replace the plugin with an alternative if no fix is released.

Workarounds

• Remove the plugin if a maintained alternative meets the same functional requirements.
• Deploy a WAF with XSS protection rules in front of WordPress to filter malicious payloads targeting the plugin.
• Implement a strict Content Security Policy that restricts inline script execution and limits script sources to trusted origins.
• Train administrators and editors to avoid clicking unsolicited links pointing to WordPress admin URLs.

# Example: Disable the vulnerable plugin via WP-CLI
wp plugin deactivate authors-autocomplete-meta-box
wp plugin delete authors-autocomplete-meta-box