CVE-2025-27341: Reactive Mortgage Calculator XSS Flaw

CVE-2025-27341 Overview

CVE-2025-27341 is a stored cross-site scripting (XSS) vulnerability affecting the Reactive Mortgage Calculator plugin for WordPress developed by afzal_du. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the browser context of any user who views the affected page. The vulnerability affects all plugin versions up to and including 1.1.

Critical Impact
An authenticated attacker can persist malicious JavaScript in WordPress content served by the Reactive Mortgage Calculator plugin, leading to session compromise, credential theft, or forced administrative actions when victims render the affected page.

Affected Products

Reactive Mortgage Calculator plugin for WordPress by afzal_du
All versions from unspecified initial release through 1.1
WordPress sites installing the reactive-mortgage-calculator plugin

Discovery Timeline

2025-02-24 - CVE-2025-27341 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27341

Vulnerability Analysis

The Reactive Mortgage Calculator plugin fails to sanitize or encode user-controlled input before storing it and rendering it back into HTML output. This weakness allows an authenticated contributor-level user to persist attacker-controlled markup and script tags in plugin-managed content. When another user, including an administrator, loads a page containing the injected payload, the browser executes the script in the site's origin.

Exploitation requires user interaction and privileges on the target WordPress instance. The scope change indicates that a successful attack can affect resources beyond the vulnerable component, such as the administrator's browser session or other tenants of the WordPress site. Successful payloads can hijack sessions, exfiltrate cookies, deface pages, or trigger authenticated requests through the victim's browser.

Root Cause

The root cause is missing input validation and output encoding in plugin fields that accept user data. The plugin stores raw input in the WordPress database and later reflects it into rendered HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). This bypasses the standard defense-in-depth model expected of WordPress plugins.

Attack Vector

The attack vector is network-based over standard HTTP or HTTPS to the WordPress site. An attacker authenticates with low-privilege credentials, submits a payload through a plugin input field, and waits for a higher-privileged user to view the affected content. Because the payload is stored, exploitation is repeatable and does not require the attacker to remain online. Refer to the Patchstack Vulnerability Advisory for advisory-level detail.

Detection Methods for CVE-2025-27341

Indicators of Compromise

Unexpected <script>, <img onerror=...>, or <iframe> markup persisted in WordPress post content or plugin option tables such as wp_options and wp_postmeta.
Outbound requests from administrator browsers to unfamiliar domains immediately after loading pages that render Reactive Mortgage Calculator output.
New or modified WordPress administrator accounts created shortly after an administrator viewed plugin-controlled content.

Detection Strategies

Audit the WordPress database for stored plugin fields containing HTML control characters such as <, >, ", ', or JavaScript event handlers.
Deploy a Web Application Firewall rule that flags submissions to reactive-mortgage-calculator endpoints containing script tags or event handler attributes.
Review WordPress access logs for POST requests to plugin routes originating from low-privileged accounts followed by GET requests from administrator sessions.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on pages hosting the plugin.
Monitor for anomalous session activity on WordPress administrator accounts, including new cookies, unexpected token issuance, or privilege changes.
Alert on modifications to plugin-managed database rows outside of expected administrative maintenance windows.

How to Mitigate CVE-2025-27341

Immediate Actions Required

Disable and remove the Reactive Mortgage Calculator plugin from WordPress installations until a patched version is confirmed available.
Rotate WordPress administrator passwords and invalidate active sessions on any site where the plugin was installed and accessible to untrusted contributors.
Audit all plugin-controlled fields and remove any injected HTML or JavaScript payloads discovered in the database.

Patch Information

No fixed version is listed in the referenced advisory at the time of publication. Version 1.1 and all prior releases are affected. Site operators should track the Patchstack advisory and the plugin's WordPress.org page for a patched release, and apply updates promptly once published.

Workarounds

Restrict WordPress user roles so that only trusted administrators can access plugin input fields, reducing the pool of accounts capable of triggering the vulnerability.
Deploy a virtual patch through a WAF or Patchstack integration that blocks requests containing script content to the plugin's endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, limiting XSS payload execution.

bash

# Configuration example: deactivate and remove the vulnerable plugin via WP-CLI
wp plugin deactivate reactive-mortgage-calculator
wp plugin delete reactive-mortgage-calculator

# Audit stored plugin options for suspicious HTML markup
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"