CVE-2025-30600: WP Hotjar Stored XSS Vulnerability

CVE-2025-30600 Overview

CVE-2025-30600 is a stored cross-site scripting (XSS) vulnerability in the WP Hotjar WordPress plugin by thiagogsrwp. The flaw affects all versions of WP Hotjar up to and including 0.0.3. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Stored payloads execute in the browsers of users who view the affected pages. The issue maps to CWE-79 and was disclosed through Patchstack.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in other users' browsers, enabling session hijacking, forced administrative actions, and content defacement within the WordPress admin scope.

Affected Products

WP Hotjar plugin (wp-hotjar) by thiagogsrwp
All versions from n/a through 0.0.3
WordPress installations with the plugin installed and active

Discovery Timeline

2025-03-24 - CVE-2025-30600 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30600

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WP Hotjar plugin. Stored XSS occurs when an application accepts untrusted input, persists it in a backend store, and later renders that input in a web page without sufficient output encoding or input sanitization. In this plugin, at least one input handler writes attacker-controlled data into WordPress storage. The data is later reflected into rendered pages within the admin or front-end context.

Exploitation requires an authenticated session with high privileges and user interaction from the victim. The scope is changed, which means the injected script can affect a security context beyond the vulnerable component, such as other logged-in users viewing plugin-generated output. Confidentiality, integrity, and availability impacts are all rated low, consistent with browser-side script execution rather than direct server compromise.

Root Cause

The root cause is improper neutralization of input during web page generation ([CWE-79]). The plugin does not apply appropriate WordPress sanitization functions such as sanitize_text_field(), wp_kses(), or esc_html() on stored input before rendering. As a result, HTML and JavaScript characters supplied by an attacker survive into the DOM of a generated page.

Attack Vector

An authenticated attacker submits a crafted payload containing HTML or JavaScript through a plugin-controlled input in the WordPress admin. The plugin persists the payload in the database. When a privileged user later browses a page that renders that stored value, the script executes in the victim's browser session. Typical payloads target the WordPress administrator cookie context to perform account takeover, plant a backdoor user, or pivot to the underlying site. See the Patchstack Vulnerability Report for the technical write-up.

No verified public proof-of-concept code has been published for this issue. The vulnerability mechanism is described in prose only; the plugin stores unsanitized input and reflects it without escaping during page rendering.

Detection Methods for CVE-2025-30600

Indicators of Compromise

Unexpected <script>, <svg>, onerror=, or onload= fragments stored in wp_options, wp_postmeta, or plugin-owned tables associated with wp-hotjar.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin-generated pages.
New WordPress administrator accounts, unexpected role changes, or modified wp_users entries following admin sessions.
Modifications to plugin or theme files following an authenticated admin viewing the affected pages.

Detection Strategies

Review database rows written by the WP Hotjar plugin for HTML tags, event handlers, or JavaScript URI schemes.
Enable and monitor WordPress audit logging for changes to plugin settings and posts by high-privileged users.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution originating from wp-admin pages.

Monitoring Recommendations

Alert on creation of new administrator accounts and privilege escalations within WordPress user tables.
Monitor web server logs for POST requests to WP Hotjar endpoints from non-standard user agents or IP ranges.
Correlate browser-side errors and CSP violations reported by administrator workstations with WordPress admin activity.

How to Mitigate CVE-2025-30600

Immediate Actions Required

Deactivate and remove the WP Hotjar plugin from any WordPress site running version 0.0.3 or earlier until a patched release is confirmed.
Rotate WordPress administrator passwords and invalidate active sessions after removing the plugin.
Audit stored plugin data for injected HTML or JavaScript and purge malicious content from the database.
Review recently created users, scheduled tasks (wp_cron), and modified theme or plugin files for signs of post-exploitation activity.

Patch Information

At the time of the last NVD update, no fixed version is listed. The advisory identifies all versions through 0.0.3 as vulnerable and does not name a patched release. Monitor the Patchstack Vulnerability Report and the plugin repository for updates before reinstalling.

Workarounds

Uninstall the plugin and replace its functionality with a maintained alternative until a patched version is released.
Restrict high-privilege WordPress accounts to trusted administrators and enforce multi-factor authentication.
Deploy a Web Application Firewall (WAF) rule to block script tags and common XSS payload patterns in requests to plugin endpoints.
Enforce a strict Content Security Policy on wp-admin to prevent execution of inline scripts.

bash

# Configuration example: remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-hotjar
wp plugin delete wp-hotjar
wp user session destroy --all