CVE-2025-30575 Overview
CVE-2025-30575 is a stored Cross-Site Scripting (XSS) vulnerability in the Arefly Login Redirect WordPress plugin. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. It affects all versions of the login-redirect plugin up to and including 1.0.5.
An authenticated attacker with high privileges can inject malicious script content that persists in the application. The payload executes in the browsers of other users who view the affected page, requiring user interaction to trigger.
Critical Impact
A high-privileged attacker can store JavaScript payloads that execute in victim browsers, enabling session theft, administrative action abuse, and cross-scope compromise within the WordPress site.
Affected Products
- Arefly Login Redirect (login-redirect) plugin for WordPress
- All plugin versions from initial release through 1.0.5
- WordPress sites where the plugin is installed and activated
Discovery Timeline
- 2025-03-24 - CVE-2025-30575 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30575
Vulnerability Analysis
The Login Redirect plugin fails to properly sanitize and encode user-supplied input before rendering it back into HTML output. This deficiency in output encoding allows attacker-controlled strings to be interpreted as executable script markup by the browser.
Because the injected payload is stored in the WordPress backend, every subsequent visitor to the affected page triggers execution. The stored nature of the flaw means the malicious code persists across sessions until the entry is removed. Exploitation requires an authenticated user with high privileges and user interaction from a victim.
The scope changes upon exploitation, meaning the script can affect resources beyond the vulnerable component's security boundary. This is characteristic of XSS flaws where injected JavaScript runs in the victim's authenticated session context.
Root Cause
The root cause is missing or insufficient input neutralization on plugin settings or fields that accept text input from privileged users. The plugin writes this data back to the DOM without contextual output encoding such as HTML entity escaping. Any string containing script tags, event handlers, or JavaScript URIs is rendered as active content.
Attack Vector
Exploitation follows a standard stored XSS chain. An authenticated attacker with administrative or comparable privileges submits a crafted payload through a vulnerable input in the plugin's interface. The payload is persisted to the WordPress database.
When another user, typically an administrator or editor, loads the page containing the stored value, the browser parses and executes the injected script. The attacker can then exfiltrate cookies, perform actions on behalf of the victim, or pivot to further site compromise. See the Patchstack XSS Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30575
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in WordPress wp_options or plugin-specific tables tied to login-redirect.
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading plugin configuration pages.
- Anomalous administrator session activity such as unexpected user creation, role changes, or plugin installations following a settings page visit.
Detection Strategies
- Audit stored plugin settings for HTML or JavaScript content using database queries against wp_options and any login-redirect tables.
- Deploy a Web Application Firewall (WAF) rule set that inspects POST parameters submitted to plugin admin endpoints for script-injection patterns.
- Enable WordPress audit logging to record settings changes made by privileged users and correlate against role and session metadata.
Monitoring Recommendations
- Monitor administrator authentication events and geolocate high-privilege logins for anomalies that could precede stored payload injection.
- Alert on Content Security Policy (CSP) violation reports from WordPress admin pages, which indicate blocked inline script execution.
- Track plugin version inventory across managed WordPress sites to identify hosts running vulnerable login-redirect versions at or below 1.0.5.
How to Mitigate CVE-2025-30575
Immediate Actions Required
- Identify all WordPress installations with the Arefly Login Redirect plugin at version 1.0.5 or earlier and prioritize remediation.
- Review administrator and high-privilege user accounts, rotate credentials, and enforce multi-factor authentication to reduce exploitation risk.
- Inspect plugin settings for previously injected payloads and purge any stored HTML or JavaScript content before restoring normal operations.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry. Administrators should consult the Patchstack advisory for the latest vendor guidance and deactivate the plugin if a patched release is unavailable.
Workarounds
- Deactivate and remove the login-redirect plugin until a patched version is released by the vendor.
- Restrict administrative access using IP allowlists and enforce least-privilege role assignments to limit who can write to plugin settings.
- Deploy a virtual patch through a WordPress-focused WAF such as Patchstack or equivalent to block XSS payloads targeting the plugin endpoints.
# Configuration example: locate and disable the vulnerable plugin via WP-CLI
wp plugin list --name=login-redirect --field=version
wp plugin deactivate login-redirect
wp plugin delete login-redirect
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
