CVE-2025-26770: Waymark Plugin Stored XSS Vulnerability

CVE-2025-26770 Overview

CVE-2025-26770 is a stored Cross-Site Scripting (XSS) vulnerability in the Joe Waymark waymark WordPress plugin. The flaw affects all versions of Waymark up to and including 1.5.0. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with low privileges to inject persistent JavaScript payloads. When another user renders the affected page, the injected script executes in their browser context. The issue is tracked under CWE-79 and was published to the National Vulnerability Database (NVD) by Patchstack.

Critical Impact
A low-privileged authenticated user can store malicious JavaScript that executes in victim browsers, enabling session theft, forced actions, and content manipulation across the WordPress site.

Affected Products

Joe Waymark waymark WordPress plugin, versions up to and including 1.5.0
WordPress installations with the Waymark plugin activated
Any site content rendered through vulnerable Waymark plugin endpoints

Discovery Timeline

2025-02-17 - CVE-2025-26770 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26770

Vulnerability Analysis

The Waymark plugin renders user-controlled input into web pages without proper output encoding or sanitization. An authenticated user submits input containing HTML or JavaScript, and the plugin stores that data. When the affected page is later requested, the server returns the untrusted content directly in the HTML response. The browser interprets the payload as executable script rather than data.

Because the payload is persisted, every visitor to the affected page triggers execution. The scope change in the scoring reflects that injected script runs in the security context of the WordPress site, not just the vulnerable component. Successful exploitation can lead to authentication cookie theft, forced administrative actions through CSRF, defacement, or redirection to attacker-controlled infrastructure.

Root Cause

The root cause is improper neutralization of input during web page generation, classified under CWE-79. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to user-supplied fields before including them in rendered output. Input validation on the write path is also insufficient to strip active script content.

Attack Vector

An attacker requires a low-privileged authenticated account on the target WordPress site. Exploitation requires user interaction, meaning a victim must load the page containing the stored payload. The attacker submits a crafted request to a Waymark plugin endpoint that persists an XSS payload. When an administrator or other user views the affected content, the script executes with that user's session privileges. See the Patchstack Waymark Plugin XSS Vulnerability advisory for reference details.

No public proof-of-concept exploit code has been published for this specific issue.

Detection Methods for CVE-2025-26770

Indicators of Compromise

Waymark plugin database entries or post metadata containing <script>, onerror=, onload=, or javascript: sequences
Unexpected outbound requests from administrator browsers to unfamiliar domains following page loads
New or modified WordPress administrator accounts created shortly after Waymark content edits
Web server access logs showing POST requests from low-privileged accounts to Waymark endpoints with encoded HTML entities

Detection Strategies

Scan the WordPress database for stored HTML and JavaScript patterns within Waymark-managed tables and post content
Deploy a Web Application Firewall (WAF) rule set that flags XSS payloads targeting /wp-admin/ and Waymark plugin request paths
Enable a strict Content Security Policy (CSP) and monitor report-uri telemetry for inline script violations originating from Waymark pages
Correlate authenticated user activity with content modifications to identify low-privileged accounts writing script-containing fields

Monitoring Recommendations

Forward WordPress audit logs, web server access logs, and WAF events to a centralized analytics platform for correlation
Alert on installations of Waymark plugin versions at or below 1.5.0 across managed WordPress fleets
Monitor administrator session activity for unexpected privilege changes or plugin configuration edits after page views

How to Mitigate CVE-2025-26770

Immediate Actions Required

Identify every WordPress site running the Waymark plugin and confirm the installed version
Update Waymark to a version later than 1.5.0 once the vendor publishes a patched release
Audit user accounts and revoke posting privileges for accounts that do not require them
Review Waymark-managed content for stored payloads and sanitize or remove suspicious entries

Patch Information

At the time of publication, the NVD entry references the vulnerability affecting Waymark versions up to and including 1.5.0. Consult the Patchstack advisory for the latest fixed-version guidance and apply the vendor update through the WordPress plugin manager once available.

Workarounds

Deactivate the Waymark plugin until a patched version is installed if the plugin is not business-critical
Restrict Waymark editing capabilities to trusted administrator accounts through a role management plugin
Deploy a WAF rule that blocks HTML and script tags in POST requests targeting Waymark endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress front-end and admin pages

bash

# Example WP-CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=waymark --fields=name,status,version
wp plugin deactivate waymark
wp plugin update waymark