CVE-2025-28885: Fiverr Search Box Stored XSS Vulnerability

CVE-2025-28885 Overview

CVE-2025-28885 is a stored Cross-Site Scripting (XSS) vulnerability in the fiverr-official-search-box WordPress plugin developed by fiverraffiliates. The flaw affects all plugin versions up to and including 1.0.8. Attackers with authenticated low-privilege access can inject malicious script content that persists in the page output. When another user renders the affected page, the injected payload executes in their browser context.

The underlying weakness is Improper Neutralization of Input During Web Page Generation [CWE-79]. Exploitation requires user interaction and one authenticated low-privileged account.

Critical Impact
Successful exploitation allows session hijacking, credential theft, and unauthorized actions performed on behalf of victims visiting compromised WordPress pages.

Affected Products

Fiverr.com Official Search Box WordPress plugin versions n/a through 1.0.8
WordPress sites running the fiverr-official-search-box plugin
Any site administrator or visitor rendering plugin-generated output

Discovery Timeline

2025-03-26 - CVE-2025-28885 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28885

Vulnerability Analysis

The Fiverr.com Official Search Box plugin fails to properly neutralize user-supplied input before rendering it in generated web pages. Input submitted through plugin-controlled fields is stored server-side without sufficient sanitization or output encoding. When a WordPress page invokes the vulnerable component, the stored payload is emitted directly into the HTML response.

Because the payload persists in the database, every visitor who loads the affected page triggers execution. The scope is marked as changed, meaning the injected script can affect resources beyond the vulnerable component itself, including the broader WordPress administrative context.

Root Cause

The root cause is missing input sanitization and missing contextual output encoding within the plugin's page-generation logic. The plugin trusts authenticated contributor-level or higher input and writes it back to the DOM without escaping HTML control characters such as <, >, ", and '. WordPress functions such as esc_html(), esc_attr(), and wp_kses() are not consistently applied to plugin-managed fields.

Attack Vector

An authenticated attacker with low privileges submits a crafted payload containing JavaScript through a plugin input field. The payload is stored in the WordPress database. When an administrator or another visitor loads a page rendering the plugin content, their browser executes the script under the site's origin. The attacker can steal session cookies, perform CSRF-style actions, or pivot to administrative account takeover.

No verified proof-of-concept code has been published. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-28885

Indicators of Compromise

Unexpected <script>, onerror=, or onload= attributes stored in wp_options, wp_postmeta, or plugin-specific database tables
Outbound requests from administrator browsers to unknown domains shortly after loading pages containing the plugin
New or modified WordPress administrator accounts appearing without a corresponding admin action

Detection Strategies

Audit rendered HTML on pages using the fiverr-official-search-box shortcode for unescaped user input
Query the WordPress database for plugin-controlled fields containing HTML tags or JavaScript event handlers
Review web server access logs for authenticated POST requests to plugin endpoints followed by anomalous GET traffic from other sessions

Monitoring Recommendations

Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin pages
Monitor WordPress audit logs for content edits by contributor and author roles on pages that use the vulnerable plugin
Alert on new administrator role assignments and unexpected changes to wp_users or wp_usermeta

How to Mitigate CVE-2025-28885

Immediate Actions Required

Deactivate and remove the fiverr-official-search-box plugin until a patched version is confirmed available
Review all WordPress user accounts and revoke unnecessary contributor, author, and editor privileges
Rotate WordPress administrator passwords and invalidate active sessions for all privileged accounts
Inspect plugin-managed database rows for stored payloads and remove any malicious content

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Affected versions include all releases up to and including 1.0.8. Consult the Patchstack XSS Vulnerability Report for updates on vendor remediation status.

Workarounds

Restrict plugin usage to trusted administrator accounts only and remove the plugin from sites where it is not required
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in requests targeting plugin endpoints
Enforce a strict Content Security Policy that disallows inline script execution on WordPress-generated pages

bash

# Example CSP header for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;