CVE-2025-30574 Overview
CVE-2025-30574 is a stored Cross-Site Scripting (XSS) vulnerability in the Jenst Mobile Navigation plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of visitors and administrators viewing affected pages. The issue affects all versions of the Mobile Navigation plugin up to and including 1.5.
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account takeover through persistent script execution against site visitors and administrators.
Affected Products
- Jenst Mobile Navigation plugin for WordPress
- All versions from initial release through 1.5
- WordPress installations with the mobile-navigation plugin active
Discovery Timeline
- 2025-03-24 - CVE-2025-30574 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30574
Vulnerability Analysis
The vulnerability resides in the Mobile Navigation plugin's handling of user-controlled input rendered into WordPress pages. The plugin fails to sanitize or escape input before storing it and rendering it into HTML output. This produces a stored XSS condition where injected payloads persist in the database and execute for every subsequent viewer of the affected page.
Exploitation requires an authenticated user with elevated privileges and user interaction to trigger the payload. Because the scope is changed, injected scripts can execute in a security context different from the vulnerable component, expanding the attack impact to other site users including administrators. Successful exploitation can lead to session token theft, forced administrative actions via forged requests, defacement, and redirection to attacker-controlled resources.
Root Cause
The root cause is missing output encoding and input sanitization within the plugin's page generation logic. WordPress plugins are expected to use functions such as esc_html(), esc_attr(), and wp_kses() to neutralize HTML control characters. The Mobile Navigation plugin renders attacker-supplied strings directly into the DOM, allowing <script> tags and event-handler attributes to survive to the browser.
Attack Vector
The attack vector is network-based and targets the WordPress administrative interface. A privileged attacker submits crafted input containing JavaScript through a plugin configuration field or content region. The payload is stored server-side and executes when a victim loads a page rendered by the plugin. See the Patchstack XSS Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30574
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_options, wp_postmeta, or plugin-specific tables.
- Outbound requests from visitor browsers to unknown domains originating from pages that render the Mobile Navigation menu.
- Newly created administrator accounts or modified user roles following plugin configuration changes.
Detection Strategies
- Audit plugin settings and database records for HTML markup or JavaScript in fields intended to hold plain text.
- Review web server access logs for POST requests to plugin configuration endpoints from unexpected users or IP addresses.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations tied to plugin-rendered pages.
Monitoring Recommendations
- Monitor WordPress audit logs for changes to Mobile Navigation settings by high-privilege users.
- Alert on file integrity changes within wp-content/plugins/mobile-navigation/.
- Track anomalous administrator session activity, including impossible-travel logins and privilege changes.
How to Mitigate CVE-2025-30574
Immediate Actions Required
- Disable and remove the Mobile Navigation plugin until a patched release is available and verified.
- Review all administrator and editor accounts for unauthorized changes and rotate credentials for privileged users.
- Scan the WordPress database for stored script payloads and remove any malicious entries.
Patch Information
No fixed version is currently listed in the advisory. The vulnerability affects Mobile Navigation through version 1.5 with no vendor-supplied patch identified at time of publication. Site operators should track the Patchstack advisory for updates and apply a fixed release immediately when published.
Workarounds
- Restrict administrative access to the WordPress dashboard using IP allowlists and multi-factor authentication.
- Apply a Web Application Firewall (WAF) rule that blocks script tags and event-handler attributes in requests to plugin configuration endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts to limit XSS payload execution.
- Replace the plugin with a maintained alternative that follows current WordPress sanitization standards.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
