CVE-2025-31391 Overview
CVE-2025-31391 is a Cross-Site Request Forgery (CSRF) vulnerability in the regen Script Compressor WordPress plugin that leads to Stored Cross-Site Scripting (XSS). The flaw affects all versions of script-compressor up to and including 1.7.1. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the plugin's stored configuration. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows attackers to store malicious JavaScript through forged administrator requests, enabling session theft, account takeover, and persistent backdoors on affected WordPress sites.
Affected Products
- regen Script Compressor WordPress plugin
- Versions from n/a through <= 1.7.1
- WordPress sites with the script-compressor plugin installed and active
Discovery Timeline
- 2025-04-09 - CVE-2025-31391 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-31391
Vulnerability Analysis
The vulnerability combines two distinct weaknesses into a single exploitation chain. The Script Compressor plugin fails to validate the origin of state-changing requests through anti-CSRF tokens, commonly implemented in WordPress via wp_nonce_field() and check_admin_referer(). The plugin also fails to sanitize input stored in its configuration, which is later rendered in the administrative interface without output encoding.
An unauthenticated attacker can host a crafted page that issues a forged request to a vulnerable WordPress site. When an authenticated administrator visits the attacker-controlled page, the browser submits the request using the admin's active session. The forged request writes attacker-controlled JavaScript into a persistent plugin setting. The script then executes whenever an administrator loads the affected page, producing a Stored XSS condition.
The attack requires user interaction, but no privileges on the target system. The scope is changed because injected scripts execute in the WordPress admin context and can act beyond the plugin's own boundary.
Root Cause
The root cause is the absence of CSRF token validation on settings-handling endpoints combined with missing input sanitization on stored configuration values. Both server-side defenses required by the WordPress Plugin Handbook are absent in versions through 1.7.1.
Attack Vector
Exploitation occurs over the network through a victim-initiated HTTP request. The attacker delivers a phishing link, malicious advertisement, or compromised page containing a hidden form or fetch call targeting the plugin's admin handler. Once the administrator visits the page while logged in, the stored payload is written and persists until removed. See the Patchstack WordPress Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-31391
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript present in Script Compressor plugin settings stored in the wp_options table.
- Administrator sessions originating from unfamiliar IP addresses or geographies shortly after a settings change in script-compressor.
- New or modified WordPress administrator accounts that cannot be attributed to legitimate activity.
- Outbound HTTP requests from administrator browsers to unknown domains immediately after loading the plugin's admin pages.
Detection Strategies
- Inspect plugin option rows in wp_options for values containing HTML tags, javascript: URIs, or base64-encoded payloads.
- Review web server access logs for POST requests to wp-admin endpoints associated with script-compressor that lack a valid Referer header pointing to the same origin.
- Audit WordPress activity logs for plugin configuration changes correlated with administrator page visits to external sites.
Monitoring Recommendations
- Enable file integrity monitoring across the wp-content/plugins/script-compressor directory and the WordPress options table.
- Forward WordPress audit logs and web server logs to a centralized analytics platform for correlation against known CSRF and XSS patterns.
- Alert on administrator account creation events and role changes that occur outside approved change windows.
How to Mitigate CVE-2025-31391
Immediate Actions Required
- Identify all WordPress installations running the Script Compressor plugin at version 1.7.1 or earlier and deactivate the plugin until a fixed release is verified.
- Audit the wp_options table for plugin entries containing script content and remove any injected payloads.
- Force a password reset and session invalidation for all WordPress administrator accounts on affected sites.
- Review installed plugins, themes, and administrator accounts for unauthorized modifications.
Patch Information
At the time of publication, no fixed version is referenced in the NVD entry for CVE-2025-31391. Monitor the Patchstack advisory and the plugin's WordPress.org listing for a patched release above 1.7.1. Apply the update across all environments once available.
Workarounds
- Remove or deactivate the script-compressor plugin until the vendor releases a patched version.
- Restrict access to wp-admin using IP allow-listing or VPN to reduce exposure to drive-by CSRF delivery.
- Deploy a Web Application Firewall (WAF) rule that enforces Referer and Origin header validation on WordPress admin POST requests.
- Require administrators to use isolated browser profiles that are not used for general browsing while authenticated to WordPress.
# Disable the vulnerable plugin via WP-CLI across affected sites
wp plugin deactivate script-compressor --all
wp plugin status script-compressor
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
