CVE-2025-30875: WP Weixin WordPress Plugin XSS Vulnerability

CVE-2025-30875 Overview

CVE-2025-30875 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Weixin WordPress plugin developed by Alexandre Froger. The flaw affects all plugin versions up to and including 1.3.16. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Exploitation requires an authenticated attacker with high privileges and user interaction, but the scope change allows the injected payload to impact resources beyond the vulnerable component. Successful attacks can compromise the confidentiality, integrity, and availability of affected WordPress sites.

Critical Impact

Attackers with elevated privileges can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, defacement, and administrative account takeover.

Affected Products

• WP Weixin plugin versions up to and including 1.3.16
• WordPress installations running the vulnerable plugin
• Sites integrating WeChat authentication through WP Weixin

Discovery Timeline

• 2025-09-09 - CVE-2025-30875 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30875

Vulnerability Analysis

The WP Weixin plugin fails to properly sanitize and encode user-supplied input before rendering it in generated web pages. An authenticated attacker submits crafted input containing JavaScript payloads through a vulnerable plugin interface. The malicious content persists in the WordPress database and executes each time a victim loads the affected page.

Because the vulnerability has a changed scope, injected scripts operate outside the security context of the plugin itself. Payloads can access administrator sessions, modify site content, exfiltrate cookies, or pivot to other WordPress components. See the Patchstack XSS Vulnerability Report for the vendor-verified technical breakdown.

Root Cause

The underlying defect is missing output encoding and input sanitization on data flowing from privileged plugin forms into rendered HTML. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() for safe output, but these controls are not applied on the affected code path. Stored input is echoed directly into the response body, allowing script tags and event handlers to execute.

Attack Vector

Exploitation proceeds over the network against an authenticated administrative interface. The attacker submits a payload containing JavaScript through a vulnerable plugin field. A second user, typically an administrator or visitor with an active session, must load the affected page for the payload to fire. The stored nature of the flaw means a single successful injection persists until the record is removed.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is documented in the referenced Patchstack advisory rather than reproduced here.

Detection Methods for CVE-2025-30875

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handler attributes stored in WordPress post, option, or user meta tables tied to WP Weixin
• Outbound HTTP requests from administrator browsers to unknown domains shortly after loading pages served by the plugin
• New or modified WordPress administrator accounts created without a corresponding audit trail

Detection Strategies

• Query the wp_options, wp_postmeta, and wp_usermeta tables for WP Weixin records containing HTML tags or URL-encoded script payloads
• Enable WordPress debug logging and review web server access logs for POST requests to WP Weixin endpoints containing suspicious characters such as <, >, and onerror=
• Deploy a web application firewall rule set that flags stored XSS patterns targeting /wp-admin/ routes

Monitoring Recommendations

• Alert on modifications to WP Weixin plugin settings performed outside normal administrative windows
• Monitor administrator session activity for anomalous API calls or content changes following plugin page loads
• Track file integrity of WordPress core and plugin directories to identify secondary compromise from a successful XSS chain

How to Mitigate CVE-2025-30875

Immediate Actions Required

• Identify all WordPress sites running WP Weixin version 1.3.16 or earlier and prioritize them for remediation
• Restrict administrative access to trusted networks and enforce multi-factor authentication for all privileged accounts
• Audit stored plugin data for injected payloads and purge any malicious content before restoring normal operations

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 1.3.16 as affected. Administrators should consult the Patchstack XSS Vulnerability Report and the plugin developer's channels for updated release information and apply the fixed version once available.

Workarounds

• Disable and remove the WP Weixin plugin until a patched version is released and validated
• Apply a virtual patch through a web application firewall to block XSS payloads targeting WP Weixin request parameters
• Implement a Content Security Policy that restricts inline script execution and limits permitted script sources

# Configuration example: Content-Security-Policy header for WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"