CVE-2025-30942 Overview
CVE-2025-30942 is a stored cross-site scripting (XSS) vulnerability in the OTWthemes Post Custom Templates Lite plugin for WordPress. The flaw affects all plugin versions up to and including 1.14. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].
An authenticated attacker with high privileges can inject persistent JavaScript payloads. The payloads execute in the browsers of users who load the affected pages. Because the vulnerability crosses a security scope boundary, it can affect components beyond the plugin itself.
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative action forgery within the WordPress administration context.
Affected Products
- OTWthemes Post Custom Templates Lite (post-custom-templates-lite) WordPress plugin
- All versions from initial release through 1.14
- WordPress installations with the plugin activated
Discovery Timeline
- 2025-06-06 - CVE-2025-30942 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30942
Vulnerability Analysis
The Post Custom Templates Lite plugin fails to sanitize or encode user-controlled input before rendering it inside HTML output. An authenticated user with high privileges can submit input containing HTML or JavaScript. The plugin then stores this input and later renders it in a web page without proper neutralization.
Exploitation requires user interaction, meaning a target must load a page that renders the malicious payload. Once triggered, the injected script executes in the victim's browser under the origin of the WordPress site. The scope change indicates the impact extends beyond the vulnerable component, typically reaching the administrative interface or other authenticated sessions.
Root Cause
The root cause is missing output encoding and input sanitization in template-rendering routines of the plugin. Data supplied through plugin configuration or template fields is written directly into the Document Object Model (DOM) without escaping. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() that the plugin does not consistently apply to affected sinks.
Attack Vector
The attack vector is network-based and requires an authenticated high-privilege account combined with victim interaction. An attacker with plugin management access injects a JavaScript payload into a template or plugin-controlled field. When another user, often an administrator, views the affected page, the stored payload executes. The attacker can steal session cookies, hijack accounts, or perform privileged actions on behalf of the victim.
The vulnerability is documented in the Patchstack Vulnerability Report.
Detection Methods for CVE-2025-30942
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript stored in plugin template fields or post metadata
- WordPress user accounts created or elevated without a corresponding administrator action
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin pages
- Modifications to plugin templates or theme files by accounts with only editor or contributor roles
Detection Strategies
- Inspect the WordPress database (wp_posts, wp_postmeta, and plugin option tables) for HTML or JavaScript payloads in fields that should contain plain text
- Monitor web server access logs for POST requests to plugin administration endpoints from unexpected users
- Deploy a Web Application Firewall (WAF) rule set that flags script tags and JavaScript event handlers in plugin request bodies
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution in the admin interface
- Audit WordPress user roles and capabilities on a recurring schedule to reduce the number of high-privilege accounts
- Alert on plugin file modifications and database writes to plugin option tables outside change windows
How to Mitigate CVE-2025-30942
Immediate Actions Required
- Deactivate the Post Custom Templates Lite plugin until a patched version is installed
- Review all high-privilege WordPress accounts and rotate credentials for any that may be compromised
- Purge any stored payloads from plugin templates and post metadata before reactivation
- Enable multi-factor authentication (MFA) on all administrator and editor accounts
Patch Information
The vulnerability affects Post Custom Templates Lite versions up to and including 1.14. Consult the Patchstack Vulnerability Report for the current patched release. Apply the vendor update through the WordPress plugin management console once available.
Workarounds
- Remove the plugin from production sites where a patched version is not yet available
- Restrict plugin management capabilities to a minimal set of trusted administrators
- Deploy a WAF rule that blocks script payloads submitted to plugin endpoints
- Enforce a strict Content Security Policy that disables inline script execution in the WordPress admin area
# Configuration example: disable the plugin via WP-CLI pending a patch
wp plugin deactivate post-custom-templates-lite
wp plugin delete post-custom-templates-lite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
