CVE-2025-31093: RPS Include Content DOM-Based XSS Vulnerability

CVE-2025-31093 Overview

CVE-2025-31093 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the redpixelstudios RPS Include Content plugin for WordPress. The flaw affects all plugin versions up to and including 1.2.1. The issue stems from improper neutralization of user-controllable input during web page generation, classified under [CWE-79]. An authenticated attacker with low privileges can inject client-side script that executes in a victim's browser after user interaction. The scope is changed, meaning exploitation impacts resources beyond the vulnerable component. The vulnerability was published to the National Vulnerability Database (NVD) on March 28, 2025.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a WordPress site visitor's browser, potentially leading to session hijacking, credential theft, or unauthorized actions.

Affected Products

redpixelstudios RPS Include Content plugin for WordPress
All versions up to and including 1.2.1
WordPress sites with the rps-include-content plugin installed and active

Discovery Timeline

2025-03-28 - CVE-2025-31093 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31093

Vulnerability Analysis

The RPS Include Content plugin fails to properly sanitize input before it is written into the Document Object Model (DOM). This omission enables DOM-Based XSS, where malicious payloads are parsed and executed client-side without ever being reflected by the server. Exploitation requires authenticated access with low privileges and user interaction, such as clicking a crafted link or loading a manipulated page component. The changed scope indicates the injected script can affect data or components outside the vulnerable plugin, including other WordPress site resources accessible to the victim's session.

Root Cause

The root cause is missing or insufficient output encoding when the plugin processes user-supplied data and inserts it into DOM sink functions. Without contextual encoding for HTML, JavaScript, or attribute contexts, attacker-controlled content is interpreted as executable script rather than inert data. This aligns with [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

The attack vector is network-based. An attacker with a low-privileged WordPress account crafts input containing script payloads that the plugin later renders unsafely in a victim's browser. Because the payload executes in the trusted origin of the WordPress site, the attacker inherits the victim's authenticated session context. Typical outcomes include cookie theft, forced administrative actions, redirection to phishing sites, and drive-by downloads.

No verified public exploit code is available for this vulnerability. See the Patchstack WordPress XSS Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-31093

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs in plugin-rendered content
Outbound requests from browsers to unfamiliar domains after loading pages that use the rps-include-content shortcode
WordPress audit-log entries showing low-privileged users editing or creating content that leverages the plugin's include functionality

Detection Strategies

Inspect WordPress database post_content and plugin option tables for encoded or raw HTML containing script payloads
Enable a Web Application Firewall (WAF) with signatures for common XSS patterns targeting WordPress plugins
Correlate authenticated user activity with subsequent script-injection alerts in browser telemetry

Monitoring Recommendations

Monitor WordPress admin sessions for anomalous cookie access or session-token exfiltration
Log and alert on Content Security Policy (CSP) violation reports referencing plugin-rendered pages
Track plugin version inventory across WordPress deployments to identify hosts running rps-include-content at or below version 1.2.1

How to Mitigate CVE-2025-31093

Immediate Actions Required

Identify all WordPress sites running the RPS Include Content plugin at version 1.2.1 or earlier
Deactivate and remove the plugin if a patched release is not available for your environment
Rotate credentials and session tokens for any WordPress users who may have been targeted
Review recent content changes made by low-privileged accounts for injected script payloads

Patch Information

At the time of publication, no vendor-supplied patched version beyond 1.2.1 is referenced in the advisory. Consult the Patchstack WordPress XSS Vulnerability advisory for the latest remediation status and update instructions.

Workarounds

Disable the rps-include-content plugin until a fixed release is available
Restrict WordPress user role assignments to minimize the number of accounts able to invoke the plugin
Deploy a Content Security Policy (CSP) that blocks inline scripts and restricts script sources to trusted origins
Place a WAF in front of WordPress with XSS filtering rules enabled for plugin endpoints

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate rps-include-content
wp plugin delete rps-include-content