CVE-2025-31375 Overview
CVE-2025-31375 is a Cross-Site Request Forgery (CSRF) vulnerability in the bhoogterp Scheduled plugin for WordPress that chains into Stored Cross-Site Scripting (XSS). The flaw affects all versions of the plugin up to and including 1.0. An attacker can craft a malicious request that, when triggered by an authenticated administrator, injects persistent JavaScript into the WordPress site. The stored payload executes in the browser of any subsequent visitor or administrator, enabling session theft, account takeover, or further compromise of the WordPress instance. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
A single click on an attacker-controlled link by a logged-in administrator can result in persistent JavaScript injection across the WordPress site.
Affected Products
- bhoogterp Scheduled plugin for WordPress
- All versions from initial release through 1.0
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-04-09 - CVE-2025-31375 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-31375
Vulnerability Analysis
The Scheduled plugin exposes state-changing functionality without verifying request origin through anti-CSRF tokens (nonces). An attacker hosts a malicious page containing a forged request targeting a plugin endpoint that accepts user-supplied content. When an authenticated WordPress administrator visits the attacker's page, the browser submits the request with valid session cookies attached.
The plugin processes the request and stores the attacker-supplied input without sufficient output encoding or input sanitization. Because the stored content includes executable script, every subsequent page render that displays the data executes the attacker's JavaScript in the browser context of the viewer. The EPSS score is 0.104% (27.88 percentile).
Root Cause
Two defects combine to produce this issue. First, the plugin omits WordPress nonce verification (check_admin_referer or wp_verify_nonce) on requests that modify persistent state. Second, user-controlled input written by these requests is rendered without escaping using functions such as esc_html, esc_attr, or wp_kses. Either control would break the attack chain, but the plugin lacks both.
Attack Vector
Exploitation requires user interaction from a privileged WordPress user. The attacker delivers a link or embeds a forged form on an external site, typically through phishing, a compromised third-party site, or a comment containing a malicious URL. The forged request triggers automatically when the victim loads the attacker's page. The stored payload then executes for any visitor who loads the affected page, including other administrators, escalating impact across the site.
No verified proof-of-concept code is publicly available. See the Patchstack WordPress Vulnerability Report for technical details.
Detection Methods for CVE-2025-31375
Indicators of Compromise
- Unexpected <script> tags, onerror handlers, or obfuscated JavaScript in content fields managed by the Scheduled plugin.
- WordPress administrator accounts created or modified shortly after a privileged user visited an external link.
- Outbound HTTP requests from visitor browsers to unfamiliar domains when loading pages rendered by the plugin.
- Web server access logs showing POST requests to plugin endpoints with Referer headers pointing to unrelated external domains.
Detection Strategies
- Review the WordPress database for plugin-managed records containing HTML or JavaScript markup that should not appear in normal content.
- Inspect rendered HTML output of affected pages for script tags that did not originate from the theme or other trusted plugins.
- Correlate administrator session activity with referrer headers in web access logs to identify cross-site request patterns.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin configuration changes and the user account responsible for each modification.
- Deploy a web application firewall with rules that detect CSRF patterns and reflected or stored XSS payloads in POST bodies.
- Monitor browser security telemetry (Content Security Policy reports) for unexpected script execution on WordPress admin and public pages.
How to Mitigate CVE-2025-31375
Immediate Actions Required
- Deactivate and remove the bhoogterp Scheduled plugin until a patched version is released and verified.
- Audit all content stored by the plugin and remove any entries containing script markup or suspicious HTML attributes.
- Rotate WordPress administrator credentials and invalidate active sessions if the plugin has been installed.
- Review user roles and remove any unrecognized administrator accounts created since the plugin was activated.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. The vulnerability affects the plugin through version 1.0 with no fixed version listed. Monitor the Patchstack advisory for updates on a fixed release.
Workarounds
- Remove the plugin entirely if business operations do not depend on its functionality.
- Restrict administrator browsing habits and require administrators to use a dedicated browser profile that does not share sessions with general web browsing.
- Apply a Content Security Policy that blocks inline scripts and unauthorized external script sources on the WordPress site.
- Use a virtual patching capability in a web application firewall to block requests to plugin endpoints lacking valid nonces.
# Configuration example: remove the plugin via WP-CLI
wp plugin deactivate scheduled
wp plugin delete scheduled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
