CVE-2025-26551 Overview
CVE-2025-26551 is a stored cross-site scripting (XSS) vulnerability in the bootstrap-collapse WordPress plugin developed by sureshdsk. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can exploit a cross-site request forgery (CSRF) flow to inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The vulnerability affects all plugin versions up to and including 1.0.4. Successful exploitation requires user interaction, but the injected script runs with the privileges of the victim within the WordPress site context.
Critical Impact
Attackers can inject persistent JavaScript that executes in administrator and visitor browsers, enabling session theft, content manipulation, and further account compromise.
Affected Products
- sureshdsk Bootstrap collapse (bootstrap-collapse) WordPress plugin
- All versions from initial release through 1.0.4
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-02-13 - CVE-2025-26551 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-26551
Vulnerability Analysis
The bootstrap-collapse plugin fails to sanitize and encode user-controlled input before rendering it inside generated HTML output. This allows attackers to store malicious script payloads in plugin-managed content. When a WordPress user loads a page containing the stored payload, the browser executes the attacker's JavaScript in the site's origin.
The vulnerability chains with a CSRF weakness, meaning an unauthenticated attacker can trick an authenticated administrator into submitting a forged request. The forged request writes attacker-controlled markup into plugin storage. The stored payload then executes on subsequent page loads, persisting across sessions.
The EPSS probability is 0.131% with a percentile of 32.023, indicating low observed exploitation activity. No public proof-of-concept exploit is currently catalogued in CISA KEV.
Root Cause
The root cause is missing or insufficient output encoding when the plugin renders user-supplied collapse component content. The plugin does not apply WordPress sanitization helpers such as wp_kses_post(), esc_html(), or esc_attr() to data before emitting it into the DOM. Combined with the absence of CSRF nonce verification on the relevant administrative endpoints, attackers can write arbitrary script content without authenticating directly.
Attack Vector
The attack requires network access and user interaction. An attacker hosts a malicious page that submits a forged form or fetch request to a vulnerable WordPress site. An authenticated administrator visiting the attacker-controlled page triggers the request. The plugin stores the attacker's payload, which then executes whenever any user renders the affected page. The scope is changed because script execution affects browsers beyond the vulnerable component.
For technical details, see the Patchstack Vulnerability Report.
Detection Methods for CVE-2025-26551
Indicators of Compromise
- Unexpected <script> tags, onerror, or onload handlers stored in plugin-managed post or option records
- Outbound browser requests to unknown domains from pages rendering Bootstrap collapse components
- Administrator session cookies or authentication tokens appearing in external traffic logs
- New or modified WordPress administrator accounts created shortly after admin page visits
Detection Strategies
- Audit the WordPress database for bootstrap-collapse content containing HTML event handlers or <script> markers
- Review web server access logs for POST requests to plugin endpoints lacking valid referrer headers
- Monitor browser console errors and Content Security Policy (CSP) violation reports on affected pages
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin configuration changes and administrative actions
- Deploy a Content Security Policy that restricts inline script execution and reports violations
- Alert on administrator account modifications, plugin installations, and unexpected option updates
How to Mitigate CVE-2025-26551
Immediate Actions Required
- Deactivate and remove the bootstrap-collapse plugin until a patched version is confirmed available
- Audit existing plugin content and database entries for injected scripts, and remove malicious payloads
- Rotate WordPress administrator passwords and invalidate active sessions to limit post-exploitation reuse
- Review recently created users and scheduled tasks for unauthorized changes
Patch Information
No patched version has been published at the time of this advisory. The vulnerability affects all versions through 1.0.4. Monitor the Patchstack advisory and the plugin repository for updates. If a vendor fix is unavailable, replace the plugin with a maintained alternative.
Workarounds
- Restrict WordPress administrator access to trusted networks using IP allowlisting at the web server or firewall
- Enforce a strict Content Security Policy that disallows inline scripts and unknown external sources
- Require administrators to use isolated browser profiles when managing WordPress to reduce CSRF exposure
- Deploy a web application firewall rule to block requests containing script tags targeting plugin endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
