CVE-2025-31575: Flag Icons Stored XSS Vulnerability

CVE-2025-31575 Overview

CVE-2025-31575 is a stored Cross-Site Scripting (XSS) vulnerability in the Vasilis Triantafyllou Flag Icons plugin (language-icons-flags-switcher) for WordPress. The flaw stems from improper neutralization of script-related HTML tags in a web page, classified as [CWE-80]. All versions up to and including 2.2 are affected. An authenticated attacker with high privileges can inject persistent script payloads that execute in the browsers of users who load the affected page.

Critical Impact
Stored XSS payloads persist in WordPress content and execute when victims render the page, enabling session theft, administrative action abuse, and pivoting across the site's administrative context.

Affected Products

Vasilis Triantafyllou Flag Icons (language-icons-flags-switcher) versions through 2.2
WordPress installations running the vulnerable plugin
Any site rendering plugin-controlled output to authenticated users

Discovery Timeline

2025-03-31 - CVE-2025-31575 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31575

Vulnerability Analysis

The Flag Icons plugin fails to neutralize script-related HTML tags when handling attacker-controlled input that is later rendered in the WordPress front-end or administrative interface. Because the malicious content is stored server-side, the payload executes on every subsequent page load rather than requiring a crafted URL. The scope change captured in the CVSS vector indicates the injected script executes in a security context beyond the vulnerable component, typically the browser origin of any user viewing affected pages. Exploitation requires a privileged account and user interaction, which narrows practical attacker profiles but does not eliminate risk in multi-author WordPress environments.

Root Cause

The plugin does not apply sufficient output escaping or input sanitization on fields that accept HTML. Instead of stripping or encoding <script> and related tags, the vulnerable code path stores raw input and later emits it into rendered markup. This maps directly to [CWE-80]: Improper Neutralization of Script-Related HTML Tags in a Web Page.

Attack Vector

An authenticated attacker with elevated privileges submits a payload containing script tags through a plugin-controlled input field. WordPress persists the payload in the database. When another user (including administrators) loads a page that renders the stored content, the browser executes the injected script under the site's origin. Consult the Patchstack XSS Vulnerability Report for the vulnerable version details.

No verified proof-of-concept code has been published. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2025-31575

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes stored in plugin-controlled options, post metadata, or database tables associated with language-icons-flags-switcher.
New or modified administrator accounts created shortly after privileged users viewed pages rendering plugin output.
Outbound requests from browsers of authenticated WordPress users to attacker-controlled domains.

Detection Strategies

Audit database rows written by the Flag Icons plugin for HTML tags that should not appear in configuration values.
Enable and review WordPress audit logs for plugin option changes performed by high-privilege accounts.
Deploy a Content Security Policy (CSP) reporting endpoint to surface inline script violations tied to the plugin's rendered pages.

Monitoring Recommendations

Monitor web server access logs for anomalous POST requests to plugin admin endpoints from unexpected source IPs.
Alert on WordPress user role changes and unexpected privileged sessions following plugin usage.
Track browser-side errors and CSP violation reports that reference plugin URLs or resources.

How to Mitigate CVE-2025-31575

Immediate Actions Required

Disable or remove the Flag Icons (language-icons-flags-switcher) plugin until a patched release is verified.
Restrict WordPress administrative access and enforce multi-factor authentication for all high-privilege accounts.
Review stored plugin configuration and content for injected script payloads and purge malicious entries.

Patch Information

At the time of NVD publication, the advisory lists versions through 2.2 as affected. Review the Patchstack XSS Vulnerability Report and the plugin repository for the latest fixed release before re-enabling the plugin.

Workarounds

Remove the plugin from production sites and replace with a maintained alternative if a patched version is unavailable.
Enforce a strict Content Security Policy that blocks inline scripts and unapproved external script sources.
Limit which roles can modify plugin settings by applying least-privilege principles to WordPress user roles.

bash

# Example: restrict admin area access to trusted IPs via .htaccess
<Files wp-login.php>
  Require ip 203.0.113.10
</Files>
<Directory /var/www/html/wp-admin>
  Require ip 203.0.113.10
</Directory>