CVE-2025-28875 Overview
CVE-2025-28875 is a stored Cross-Site Scripting (XSS) vulnerability in the BP Email Assign Templates WordPress plugin by shanebp. The flaw affects all plugin versions up to and including 1.6. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Successful exploitation requires user interaction and can affect resources beyond the vulnerable component due to a scope change. This issue is tracked under CWE-79.
Critical Impact
Authenticated high-privilege attackers can inject persistent scripts that execute in the browsers of users viewing the affected pages, enabling session theft, administrative action hijacking, and content manipulation.
Affected Products
- shanebp BP Email Assign Templates plugin for WordPress
- Versions from n/a through 1.6 (inclusive)
- WordPress sites running BuddyPress with the vulnerable plugin installed
Discovery Timeline
- 2025-03-11 - CVE-2025-28875 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28875
Vulnerability Analysis
The BP Email Assign Templates plugin extends BuddyPress by letting administrators assign custom email templates to notification events. The vulnerability stems from improper neutralization of input during web page generation. The plugin renders attacker-controlled input in HTML contexts without adequate encoding or sanitization, so injected <script> payloads persist in the database and execute on subsequent page loads.
Exploitation requires an authenticated account with high privileges, typically an administrator role in WordPress. The attack also requires a victim to interact with the rendered content. Because the impact crosses a security boundary, the payload executes with access to resources outside the plugin's original scope, such as the WordPress admin session context.
Root Cause
The root cause is missing or insufficient output encoding on plugin-managed template fields. Values submitted through plugin configuration forms are stored verbatim and later echoed into HTML without functions such as esc_html(), esc_attr(), or wp_kses() being applied. This design flaw allows raw HTML and JavaScript to render in the page structure.
Attack Vector
An authenticated administrator or attacker who has compromised an administrator account submits a crafted payload through a plugin form field. The payload is stored in the WordPress database. When another authenticated user, including other administrators, views a page that renders that field, the browser executes the injected script. The vulnerability manifests over the network and requires user interaction. See the Patchstack Vulnerability Report for additional detail.
No public proof-of-concept or exploit code has been published for this issue at the time of writing.
Detection Methods for CVE-2025-28875
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes stored in wp_options, wp_postmeta, or plugin-specific tables tied to BP Email Assign Templates.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting BuddyPress email settings pages.
- New or modified WordPress administrator accounts created shortly after visits to plugin-managed pages.
Detection Strategies
- Audit plugin-managed database rows for HTML tags or JavaScript keywords such as <script, javascript:, onerror=, and eval(.
- Deploy a Web Application Firewall (WAF) rule to log requests to wp-admin/admin.php pages containing plugin parameters with script-like payloads.
- Correlate administrator login events with subsequent DOM-based script execution or anomalous XHR activity in browser telemetry.
Monitoring Recommendations
- Monitor WordPress audit logs for changes to BP Email Assign Templates settings and BuddyPress email templates.
- Alert on newly created privileged accounts, changes to user roles, and unexpected plugin or theme installations following template edits.
- Track HTTP responses from wp-admin pages for reflected script content that was not present in the vendor baseline.
How to Mitigate CVE-2025-28875
Immediate Actions Required
- Identify all WordPress instances running BP Email Assign Templates version 1.6 or earlier and inventory administrator accounts with access.
- Restrict plugin configuration access to a minimal set of trusted administrators until a patched version is available.
- Review stored template data for injected HTML or JavaScript and remove any suspicious content.
Patch Information
At the time of the last NVD update on 2026-06-17, no fixed version is listed in the advisory. Consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for the latest release status. Apply the vendor patch as soon as it becomes available.
Workarounds
- Deactivate and remove the BP Email Assign Templates plugin if it is not essential to site operations.
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WordPress admin pages to blunt payload execution.
- Require multi-factor authentication for all WordPress administrator accounts to reduce the risk of a compromised admin planting stored XSS.
- Place the WordPress admin interface behind a WAF configured to block common XSS patterns in plugin parameters.
# Configuration example: identify vulnerable plugin installations via WP-CLI
wp plugin list --name=bp-email-assign-templates --fields=name,status,version
wp plugin deactivate bp-email-assign-templates
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
