CVE-2025-30867: SearchIQ Stored XSS Vulnerability

CVE-2025-30867 Overview

CVE-2025-30867 is a stored cross-site scripting (XSS) vulnerability in the SearchIQ WordPress plugin. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Attackers with low-privilege authenticated access can inject malicious scripts that persist in the application and execute in the browsers of other users who view the affected pages. The issue affects all SearchIQ plugin versions up to and including 4.7.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads that execute in administrator and visitor browsers, enabling session hijacking, credential theft, and unauthorized actions within the WordPress site context.

Affected Products

SearchIQ plugin for WordPress, versions up to and including 4.7
WordPress sites with the SearchIQ search enhancement plugin installed
All configurations where the plugin's vulnerable input fields are exposed to low-privilege users

Discovery Timeline

2025-03-27 - CVE-2025-30867 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30867

Vulnerability Analysis

The SearchIQ plugin fails to properly sanitize and encode user-supplied input before rendering it in web page output. This constitutes a stored XSS vulnerability, categorized under [CWE-79]. The scope changes upon exploitation, meaning the injected payload can affect components beyond the vulnerable plugin itself, including administrator sessions and other WordPress subsystems. User interaction is required, typically a victim visiting a page where the malicious payload has been stored.

Because the payload is stored server-side, exploitation persists across sessions and can affect any user who loads the affected page. This distinguishes stored XSS from reflected variants, which require attacker-crafted links per victim.

Root Cause

The root cause is missing or insufficient output encoding in the plugin's rendering logic. User-controlled data flows from an input surface into HTML output without escaping characters such as <, >, ", and '. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() for safe output; the plugin does not consistently apply them on the affected code path.

Attack Vector

An authenticated user with low privileges submits crafted input containing HTML or JavaScript payloads through a SearchIQ plugin field. The plugin stores the input and later renders it into a page without neutralization. When another user, including an administrator, loads that page, the payload executes in their browser under the site's origin. Consult the Patchstack XSS Vulnerability Report for advisory details.

No verified proof-of-concept code is publicly available for this CVE.

Detection Methods for CVE-2025-30867

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in SearchIQ plugin database tables or option values
WordPress administrator sessions initiating unusual outbound requests, particularly to unfamiliar domains
New or modified WordPress administrator accounts created shortly after an administrator visited a page containing SearchIQ content

Detection Strategies

Audit WordPress database tables and options associated with the SearchIQ plugin for HTML and JavaScript patterns in text fields
Deploy web application firewall (WAF) rules that flag script payloads submitted to WordPress plugin endpoints
Review web server access logs for POST requests to SearchIQ endpoints containing encoded or raw XSS payload signatures

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes and content submissions by authenticated users
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages rendering SearchIQ output
Alert on anomalous browser behavior originating from administrator workstations after WordPress site visits

How to Mitigate CVE-2025-30867

Immediate Actions Required

Identify all WordPress instances running the SearchIQ plugin at version 4.7 or earlier
Restrict low-privilege user access to SearchIQ input surfaces until a patched version is applied
Review stored plugin data for injected script content and sanitize affected records

Patch Information

At the time of publication, the advisory identifies versions up to and including 4.7 as vulnerable. Site administrators should consult the Patchstack XSS Vulnerability Report and the WordPress plugin directory for the latest fixed release, and update SearchIQ once a patched version is available.

Workarounds

Deactivate the SearchIQ plugin until an updated version is confirmed and installed
Implement a strict Content Security Policy that disallows inline scripts on WordPress front-end and admin pages
Enforce least-privilege role assignments so untrusted users cannot access plugin input fields

bash

# Example: apply a Content Security Policy header at the web server layer
# nginx configuration snippet
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;