CVE-2025-30798: Better WishList API XSS Vulnerability

CVE-2025-30798 Overview

CVE-2025-30798 is a reflected Cross-Site Scripting (XSS) vulnerability in the Better WishList API WordPress plugin developed by rickonline_nl. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. All versions up to and including 1.1.4 are affected. An attacker can craft a malicious URL that, when visited by an authenticated or unauthenticated victim, executes arbitrary JavaScript in the victim's browser within the context of the vulnerable site.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, hijack sessions, steal credentials, or perform unauthorized actions on behalf of the user.

Affected Products

Better WishList API plugin for WordPress (better-wlm-api)
All versions from initial release through 1.1.4
WordPress sites with the plugin installed and active

Discovery Timeline

2025-04-01 - CVE-2025-30798 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30798

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the Better WishList API plugin. The plugin accepts input parameters through HTTP requests and reflects those values back into the rendered HTML response without proper sanitization or output encoding. When a victim is tricked into clicking a crafted link, the attacker-controlled payload executes in the browser under the origin of the vulnerable WordPress site.

Reflected XSS attacks against WordPress plugins are commonly chained with social engineering to target site administrators. If an administrator triggers the payload, the attacker can leverage the resulting JavaScript execution to perform privileged actions, such as creating new admin accounts or injecting persistent backdoors via plugin modifications.

The EPSS score indicates a meaningful probability of exploitation activity relative to the broader CVE population, placing this issue in the upper tier of likely-exploited vulnerabilities.

Root Cause

The root cause is the absence of proper input validation and output escaping in request handlers within the better-wlm-api plugin. User-controlled parameters are echoed into HTML response contexts without invoking WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

Exploitation requires a network-based request and user interaction. The attacker delivers a crafted URL containing a JavaScript payload to a victim, typically through phishing, malicious advertising, or forum posts. When the victim loads the URL, the vulnerable plugin renders the payload directly into the response. The scope-changed nature of the issue means the executed script can access resources beyond the vulnerable component's immediate trust boundary.

No verified public proof-of-concept code is currently available. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30798

Indicators of Compromise

HTTP request logs showing query parameters containing <script>, javascript:, onerror=, or onload= directed at Better WishList API endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains following access to plugin URLs
Creation of new WordPress administrator accounts shortly after suspicious plugin requests
URL-encoded JavaScript payloads in referrer headers pointing to the better-wlm-api plugin path

Detection Strategies

Inspect web server access logs for requests to better-wlm-api endpoints containing reflected payload patterns
Deploy Web Application Firewall (WAF) rules that flag XSS signatures targeting WordPress plugin parameters
Correlate authenticated admin sessions with anomalous JavaScript execution patterns reported via Content Security Policy (CSP) violation reports

Monitoring Recommendations

Enable WordPress audit logging to track plugin requests and administrative actions
Configure CSP headers in report-only mode to capture inline script execution attempts
Monitor for changes to user roles, plugin files, and theme files following suspicious request patterns
Alert on requests to /wp-content/plugins/better-wlm-api/ containing encoded HTML metacharacters

How to Mitigate CVE-2025-30798

Immediate Actions Required

Deactivate the Better WishList API plugin until a patched version is installed
Review WordPress user accounts for unauthorized administrators created during the exposure window
Rotate credentials and session tokens for all administrative accounts on affected sites
Apply WAF rules that block reflected XSS payloads targeting plugin parameters

Patch Information

At the time of publication, the advisory indicates affected versions through 1.1.4 with no fixed version explicitly stated. Site operators should consult the Patchstack Vulnerability Report and the plugin's official WordPress.org repository for updated release information.

Workarounds

Remove or disable the better-wlm-api plugin entirely if it is not business-critical
Implement a strict Content Security Policy (CSP) that disallows inline script execution
Place the WordPress site behind a WAF with up-to-date XSS detection signatures
Restrict administrative access to known IP ranges through .htaccess or web server configuration

bash

# Example: disable the plugin via WP-CLI
wp plugin deactivate better-wlm-api

# Example: nginx rule to block common reflected XSS payloads against the plugin path
location ~* /wp-content/plugins/better-wlm-api/ {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($args ~* "(javascript:|onerror=|onload=)") { return 403; }
}