CVE-2025-31075: MicroPayments Stored XSS Vulnerability

CVE-2025-31075 Overview

CVE-2025-31075 is a stored Cross-Site Scripting (XSS) vulnerability in the VideoWhisper MicroPayments (paid-membership) WordPress plugin. The flaw stems from improper neutralization of script-related HTML tags in a web page, classified as Basic XSS [CWE-80]. It affects all plugin versions up to and including 2.9.29. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. Because the scope is changed per the CVSS vector, the injected script can impact resources beyond the vulnerable component.

Critical Impact
Authenticated attackers can store malicious JavaScript that executes against site administrators and members, enabling session theft, forced actions, and further compromise of the WordPress site.

Affected Products

VideoWhisper MicroPayments plugin (paid-membership) for WordPress
All versions up to and including 2.9.29
WordPress sites with the plugin activated and user registration enabled

Discovery Timeline

2025-03-28 - CVE-2025-31075 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31075

Vulnerability Analysis

The vulnerability is a stored XSS issue in the MicroPayments paid-membership plugin. The plugin fails to properly neutralize script-related HTML tags before rendering user-supplied input in a web page. An attacker submits crafted input containing HTML or JavaScript through an affected plugin field. The payload is stored server-side and later rendered without adequate output encoding.

Exploitation requires low privileges and some user interaction, such as an administrator or member viewing the page containing the stored payload. The changed scope indicates the injected script can affect security-relevant data outside the plugin, including WordPress session cookies and administrative actions. Confidentiality, integrity, and availability impacts are each rated low, consistent with browser-executed script capabilities within an authenticated WordPress context.

Root Cause

The root cause is missing or insufficient output encoding on fields that accept HTML-tag characters. [CWE-80] specifically covers failure to strip or escape script-related tags such as <script>, <iframe>, or event-handler attributes. When these tokens are echoed back into HTML context without escaping, the browser parses and executes them.

Attack Vector

The attack path requires a network-reachable WordPress instance running a vulnerable MicroPayments version. An authenticated user submits a crafted payload through an input field the plugin persists. When a victim loads the rendered page, the stored payload executes in their browser session. See the Patchstack Vulnerability Advisory for additional technical details.

No public proof-of-concept code has been verified for this CVE. The vulnerability class is well-understood: injection points reflect unsanitized input containing HTML tag characters into a browser-rendered response, and the browser interprets the tags as active script.

Detection Methods for CVE-2025-31075

Indicators of Compromise

Unexpected <script>, <iframe>, or on* event-handler attributes stored in WordPress database tables associated with the paid-membership plugin.
Outbound browser requests from administrator sessions to unfamiliar domains shortly after loading membership or payment pages.
New or modified WordPress administrator accounts, plugins, or theme files following administrator visits to affected pages.

Detection Strategies

Audit plugin-related database rows for HTML tag characters (<, >, script, onerror, onload) using targeted SQL queries.
Enable a Content Security Policy (CSP) with reporting to surface script executions from unexpected sources.
Review WordPress access logs for POST requests to MicroPayments endpoints containing URL-encoded script payloads.

Monitoring Recommendations

Monitor WordPress admin sessions for anomalous DOM activity or unexpected fetch/XHR requests using browser telemetry.
Track file integrity of wp-content/plugins/paid-membership/ and core WordPress files for unauthorized changes.
Alert on privilege changes, new administrator role assignments, and creation of application passwords tied to admin accounts.

How to Mitigate CVE-2025-31075

Immediate Actions Required

Update the VideoWhisper MicroPayments plugin to a version later than 2.9.29 once the vendor releases a patched build.
Restrict registration and membership submission workflows to trusted users until the plugin is updated.
Force logout of active WordPress sessions and rotate administrator credentials if suspicious content is found stored in plugin fields.

Patch Information

The vulnerability affects MicroPayments through version 2.9.29. Consult the Patchstack Vulnerability Advisory and the VideoWhisper plugin repository for the current fixed release. Apply the patched version through the WordPress plugin update interface once available.

Workarounds

Deactivate the MicroPayments plugin if a patched version is unavailable and the functionality is not business-critical.
Deploy a Web Application Firewall (WAF) rule to block requests containing HTML tag characters targeting MicroPayments endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted external script sources.
Limit the WordPress roles able to submit input to plugin fields, and require administrator approval for member-submitted content.

bash

# Example restrictive Content Security Policy header for WordPress (Apache)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"