CVE-2025-30593: Include URL Plugin Stored XSS Vulnerability

CVE-2025-30593 Overview

CVE-2025-30593 is a stored cross-site scripting (XSS) vulnerability in the samsk Include URL WordPress plugin. The flaw affects all versions of the include-url plugin from the initial release through version 0.3.5. An authenticated attacker with low privileges can inject malicious script content that persists in the WordPress site and executes in the browser of any visitor who views the affected page.

The vulnerability stems from improper neutralization of user-supplied input during web page generation [CWE-79]. The scope change in the CVSS vector indicates the injected payload can affect resources beyond the vulnerable component itself.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes in victim browsers, enabling session theft, account takeover, and defacement.

Affected Products

samsk Include URL WordPress plugin (include-url)
All versions up to and including 0.3.5
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-03-24 - CVE CVE-2025-30593 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30593

Vulnerability Analysis

The Include URL plugin allows WordPress site administrators to embed external URL content inside posts and pages. The plugin fails to properly sanitize or encode input that is later rendered in generated web pages. This failure allows an attacker with contributor-level access or higher to inject JavaScript payloads that execute when a user views the affected page.

Stored XSS is distinct from reflected XSS because the malicious payload persists in the database. Every subsequent visitor who loads the compromised page executes the attacker's script in the context of the WordPress site origin. Victim interaction is required for exploitation, consistent with the user interaction requirement in the vulnerability metrics.

Root Cause

The root cause is missing output encoding and insufficient input validation on parameters processed by the include-url plugin. User-controlled input flows into HTML output without being passed through WordPress sanitization functions such as wp_kses(), esc_html(), or esc_attr(). This allows raw <script> tags and HTML event handlers to be stored and later rendered.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with low privileges, such as a contributor or editor account. The attacker submits content containing a crafted JavaScript payload through plugin-controlled fields. When an administrator or any site visitor views the affected page, the payload executes in their browser with the privileges of the current session.

Typical post-exploitation outcomes include session cookie theft, performing authenticated actions on behalf of an administrator, redirecting users to attacker-controlled sites, and injecting cryptominers or additional malware loaders. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30593

Indicators of Compromise

Unexpected <script> tags, inline event handlers (onerror, onload, onclick), or javascript: URIs stored in WordPress post and page content.
Outbound requests from site visitors to unfamiliar domains originating from pages that use the Include URL plugin.
WordPress audit logs showing content edits by low-privilege accounts to pages leveraging the include-url shortcode.

Detection Strategies

Query the WordPress wp_posts table for content containing HTML tags or JavaScript patterns that should not be present in editorial content.
Deploy a web application firewall (WAF) ruleset that inspects POST requests to WordPress admin endpoints for XSS payload signatures.
Compare the installed version of the Include URL plugin against the vulnerable range <= 0.3.5 across managed WordPress estates.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts on WordPress pages.
Monitor browser-side error telemetry and user reports of unexpected redirects or pop-ups originating from the WordPress domain.
Alert on new or modified low-privilege WordPress accounts, which are a common prerequisite for stored XSS exploitation.

How to Mitigate CVE-2025-30593

Immediate Actions Required

Deactivate the Include URL plugin on all WordPress installations until a patched version is confirmed available and deployed.
Audit all posts and pages that use the plugin for stored HTML or JavaScript content and remove any suspicious payloads.
Rotate administrator session cookies and reset credentials for any account that may have viewed a compromised page.

Patch Information

At the time of publication, no fixed version is listed in the advisory for the samsk Include URL plugin beyond 0.3.5. Monitor the Patchstack advisory for a vendor-released update. If a patch is not forthcoming, replace the plugin with a maintained alternative.

Workarounds

Remove or deactivate the include-url plugin until a fixed release is published by the maintainer.
Restrict content submission privileges so that only trusted administrator accounts can create or edit posts referencing the plugin.
Deploy a WAF rule to block requests containing <script> or JavaScript event handler payloads targeting WordPress editing endpoints.

bash

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate include-url
wp plugin delete include-url