CVE-2025-31608: CookieHint WP Stored XSS Vulnerability

CVE-2025-31608 Overview

CVE-2025-31608 is a stored cross-site scripting (XSS) vulnerability in the reDim GmbH CookieHint WP plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.0. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].

An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. Successful exploitation can lead to session theft, administrative account takeover, and delivery of secondary payloads to site visitors.

Critical Impact
Stored XSS in the CookieHint WP plugin allows low-privileged attackers to inject persistent scripts that execute against site administrators and visitors, enabling session hijacking and further compromise.

Affected Products

reDim GmbH CookieHint WP plugin for WordPress
All versions from n/a through 1.0.0
WordPress sites with the CookieHint WP plugin installed and active

Discovery Timeline

2025-03-31 - CVE-2025-31608 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31608

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the CookieHint WP plugin. Input supplied through plugin-controlled fields is stored in the WordPress database without proper sanitization or output encoding. When affected pages render, the injected content executes in the context of the victim's browser session.

The attack requires low-level authenticated access and user interaction from a victim, according to the published metrics. Because the payload is stored, it executes repeatedly against every user who loads the affected page. The scope is changed, meaning the vulnerable component can impact resources beyond its own security boundary.

Root Cause

The plugin fails to sanitize input on write and does not encode output on render. WordPress provides helper functions such as sanitize_text_field(), wp_kses_post(), and esc_html() for this purpose. Missing calls to these routines allow raw HTML and JavaScript to persist in plugin storage and reach the browser unchanged.

Attack Vector

An attacker authenticated with low privileges submits a crafted payload containing HTML or JavaScript into a plugin input field. The payload is stored in the WordPress database. When an administrator or site visitor views a page that renders the stored content, the browser executes the attacker's script.

Typical exploitation outcomes include theft of administrator session cookies, forced actions through the WordPress admin interface, and redirection of visitors to attacker-controlled infrastructure. See the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-31608

Indicators of Compromise

Presence of <script> tags, javascript: URIs, or event handlers such as onerror= and onload= in plugin-managed database records.
Unexpected outbound requests from administrator browser sessions to unknown domains after loading pages that render CookieHint WP content.
New or modified WordPress administrator accounts that cannot be attributed to authorized changes.

Detection Strategies

Review WordPress database tables for plugin-stored content containing HTML tags, encoded script fragments, or suspicious URLs.
Enable a web application firewall with rules that block common XSS payload patterns in POST requests to plugin endpoints.
Monitor WordPress audit logs for content modifications made by low-privileged accounts to plugin configuration fields.

Monitoring Recommendations

Alert on Content Security Policy (CSP) violations reported by administrator browsers when accessing WordPress admin pages.
Track authentication events for low-privileged WordPress roles, focusing on unusual editing or configuration activity.
Correlate WordPress access logs with endpoint telemetry to identify session token reuse from unexpected IP addresses.

How to Mitigate CVE-2025-31608

Immediate Actions Required

Deactivate the CookieHint WP plugin on all WordPress sites until a patched version is confirmed available.
Audit existing plugin-managed content for injected scripts and remove any unauthorized payloads.
Rotate WordPress administrator passwords and invalidate active sessions for accounts that accessed affected pages.

Patch Information

At the time of publication, the advisory lists all versions through 1.0.0 as affected and does not identify a fixed release. Monitor the Patchstack XSS Vulnerability Advisory and the reDim GmbH vendor channels for updates. Apply the fixed version as soon as it is released.

Workarounds

Remove or disable the CookieHint WP plugin and replace it with a maintained cookie consent solution.
Restrict WordPress editor and contributor roles so untrusted users cannot submit content processed by the plugin.
Deploy a web application firewall with signatures that block stored XSS payloads targeting WordPress plugin endpoints.
Enforce a strict Content Security Policy that blocks inline scripts and restricts allowed script sources.

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate cookiehint-wp
wp plugin delete cookiehint-wp

# Scan the database for suspicious script content in plugin options
wp db query "SELECT option_name FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%javascript:%';"