CVE-2025-27295 Overview
CVE-2025-27295 is a stored Cross-Site Scripting (XSS) vulnerability in the wpion Live CSS WordPress plugin. The flaw affects all versions of css-live up to and including 1.3. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject persistent JavaScript payloads. Stored XSS in a WordPress plugin context can lead to session theft, administrative account takeover, and malicious redirection of site visitors. The vulnerability is categorized under CWE-79 and requires user interaction to trigger, but no authentication is needed for exploitation in the affected scope.
Critical Impact
Attackers can inject persistent JavaScript that executes in the browsers of WordPress administrators and visitors, enabling session hijacking and site compromise.
Affected Products
- wpion Live CSS (css-live) WordPress plugin versions up to and including 1.3
- WordPress installations with the vulnerable plugin activated
- Site administrators and visitors interacting with content rendered through the plugin
Discovery Timeline
- 2025-04-17 - CVE-2025-27295 published to the National Vulnerability Database
- 2026-04-23 - Last updated in the NVD database
Technical Details for CVE-2025-27295
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Live CSS plugin for WordPress. The plugin accepts input intended for CSS customization but fails to neutralize HTML and JavaScript control characters before rendering the data in the page response. Because the payload is persisted server-side, the malicious script executes every time an affected page loads in a victim's browser.
The scope change indicated by the CVSS vector reflects that injected scripts execute in the security context of the WordPress site, not the plugin itself. An attacker who successfully injects a payload can read cookies, perform actions as the authenticated user, and pivot to administrative compromise if a privileged user views the affected page.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply output encoding functions such as esc_html(), esc_attr(), or wp_kses() to sanitize user-controlled data before embedding it in the HTML response. Plugin code paths that handle CSS-related input also fail to enforce strict allowlists on permitted characters and tags.
Attack Vector
Exploitation requires network access to the WordPress site and user interaction to trigger the stored payload. An attacker submits crafted input containing JavaScript through a plugin interface that persists the data. When a legitimate user, including an administrator, visits a page that renders the stored content, the payload executes in their browser session. Refer to the Patchstack Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-27295
Indicators of Compromise
- Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs persisted in plugin-managed data or post content
- Outbound HTTP requests from administrator browsers to unfamiliar domains after viewing pages rendered by css-live
- New or modified WordPress administrator accounts created shortly after admin sessions on affected pages
Detection Strategies
- Inspect database tables and plugin option values for HTML control characters and script-related keywords in fields managed by Live CSS
- Deploy a web application firewall rule set that flags requests containing XSS payload signatures targeting plugin endpoints
- Review WordPress audit logs for unauthorized configuration changes correlated with administrator page views
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from WordPress pages
- Monitor browser console errors and CSP violation reports for pages rendered by the Live CSS plugin
- Alert on creation of new administrator accounts, plugin installs, or theme edits that follow suspicious admin sessions
How to Mitigate CVE-2025-27295
Immediate Actions Required
- Deactivate and remove the Live CSS (css-live) plugin from all WordPress installations until a fixed version is confirmed available
- Audit existing posts, options, and plugin-stored data for injected scripts and remove malicious content
- Force password resets and invalidate active sessions for all WordPress administrator accounts
Patch Information
At the time of the advisory, the vulnerability affects all versions of Live CSS up to and including 1.3 with no fixed version listed. Monitor the Patchstack Vulnerability Advisory and the official WordPress plugin repository for an updated release. Apply the patch immediately once published.
Workarounds
- Remove the css-live plugin and replace its functionality with a maintained alternative that performs proper output encoding
- Restrict access to plugin administrative endpoints using IP allowlisting at the web server or WAF layer
- Implement a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of injected payloads
# Configuration example - remove the vulnerable plugin via WP-CLI
wp plugin deactivate css-live
wp plugin delete css-live
# Verify removal
wp plugin list | grep css-live
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
