CVE-2025-31394 Overview
CVE-2025-31394 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the More Mime Type Filters WordPress plugin by Kailey (trepmal). The flaw exists due to improper neutralization of input during web page generation. It is chained with a Cross-Site Request Forgery (CSRF) weakness, allowing attackers to persist malicious scripts when a privileged user is tricked into submitting a crafted request. The vulnerability affects all versions of the plugin up to and including 0.3.
Critical Impact
An unauthenticated attacker can inject persistent JavaScript into the WordPress admin context via CSRF, leading to session hijacking, privilege escalation, or further site compromise when an administrator visits the affected page.
Affected Products
- More Mime Type Filters WordPress plugin (more-mime-type-filters)
- All versions from n/a through 0.3
- WordPress sites running the vulnerable plugin
Discovery Timeline
- 2025-04-09 - CVE-2025-31394 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-31394
Vulnerability Analysis
The vulnerability resides in the More Mime Type Filters plugin's handling of user-supplied input during settings updates. The plugin fails to sanitize and escape input before persisting it and rendering it back in the WordPress administrative interface. Because the affected request handler also lacks CSRF protection, an attacker can craft a malicious page that submits a forged request to a target WordPress site. When an authenticated administrator visits the attacker-controlled page, the request executes under the administrator's session, storing attacker-controlled payloads in the plugin configuration.
The stored payload executes whenever any user with access to the affected admin page loads it, giving the attacker JavaScript execution in the WordPress administrative origin. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.
Root Cause
The root cause is twofold. First, the plugin omits a valid WordPress nonce check (wp_verify_nonce or check_admin_referer) on its settings handler, exposing it to CSRF. Second, input received through that handler is stored and later echoed back into HTML without esc_html, esc_attr, or equivalent output escaping. The combination converts a CSRF flaw into a persistent XSS condition [CWE-79].
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a page containing a forged form or fetch request targeting the plugin's settings endpoint. The attacker then lures an authenticated WordPress administrator to visit the page through phishing, comments, or other social engineering. Once submitted, the malicious payload is stored in the plugin options and executes in the browser of any administrator viewing the affected settings screen.
No verified public exploit code is currently available. The vulnerability mechanism is described in prose based on the Patchstack advisory.
Detection Methods for CVE-2025-31394
Indicators of Compromise
- Unexpected <script> tags or JavaScript event handlers stored in plugin option values within the wp_options table.
- Outbound requests from administrator browsers to unknown domains after visiting plugin settings pages.
- Unauthorized administrator account creation or modification of WordPress user roles following plugin settings access.
- Anomalous referer headers showing administrator settings POST requests originating from external sites.
Detection Strategies
- Inspect database entries associated with the More Mime Type Filters plugin for HTML tags, encoded scripts, or JavaScript URI schemes.
- Review WordPress access logs for POST requests to plugin admin endpoints lacking valid same-origin referers.
- Deploy Content Security Policy (CSP) reporting to surface inline script execution on /wp-admin/ pages.
Monitoring Recommendations
- Monitor file integrity and WordPress option changes through audit logging plugins or external SIEM ingestion.
- Alert on new administrator logins followed by privileged actions originating from unexpected geographies.
- Track outbound HTTP requests from administrator workstations to domains not on a known-good allowlist.
How to Mitigate CVE-2025-31394
Immediate Actions Required
- Deactivate and remove the More Mime Type Filters plugin until a patched version is released by the maintainer.
- Audit the wp_options table for malicious content stored by the plugin and remove any injected scripts.
- Force password resets and invalidate active sessions for all WordPress administrator accounts.
- Review WordPress user accounts for unauthorized additions or privilege escalations.
Patch Information
At the time of NVD publication, no fixed version of More Mime Type Filters had been released. The vulnerability affects all versions through 0.3. Administrators should monitor the Patchstack advisory and the plugin's repository for an updated release.
Workarounds
- Remove the plugin from production WordPress installations as the most reliable workaround.
- Restrict access to /wp-admin/ using IP allowlists or VPN-only access controls.
- Deploy a Web Application Firewall (WAF) rule to block requests to the plugin's settings endpoint lacking valid nonces.
- Apply a strict Content Security Policy on the WordPress admin interface to block inline script execution.
# Disable the plugin via WP-CLI until a patch is available
wp plugin deactivate more-mime-type-filters
wp plugin delete more-mime-type-filters
# Audit wp_options for suspicious script content
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
