CVE-2025-31864: Beam me up Scotty Stored XSS Vulnerability

CVE-2025-31864 Overview

CVE-2025-31864 is a stored Cross-Site Scripting (XSS) vulnerability in the Out the Box Beam me up Scotty WordPress plugin, also known as the Back to Top Button plugin. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. It affects all plugin versions up to and including 1.0.23. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who load affected pages. Successful exploitation requires user interaction and changes the security scope, allowing attacks against site visitors and administrators.

Critical Impact
Authenticated attackers can plant persistent JavaScript in the plugin's stored settings, leading to session theft, administrative account takeover, and further compromise of the WordPress site.

Affected Products

Out the Box Beam me up Scotty (Back to Top Button) WordPress plugin
All versions from initial release through 1.0.23
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-04-01 - CVE-2025-31864 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31864

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the beam-me-up-scotty plugin. Input passed to plugin settings is stored without sufficient sanitization or output encoding. When the affected page is later rendered, the stored payload executes in the victim's browser under the site's origin. Because the payload is persisted, it targets every user who loads the vulnerable view, not only the attacker's session.

Root Cause

The plugin fails to neutralize special HTML and JavaScript characters supplied through configurable fields. Output routines emit the stored values into the rendered page without contextual escaping. This violates the standard defensive controls expected for [CWE-79] and permits arbitrary script injection.

Attack Vector

Exploitation requires an authenticated user with high privileges on the WordPress site, typically an administrator role capable of modifying plugin settings. The attacker submits a crafted payload into a vulnerable plugin field. The payload persists in the WordPress database and executes when another user, including a higher-privileged administrator or a site visitor, interacts with the affected page. The scope change indicates the injected script can operate against resources beyond the vulnerable component, enabling session hijacking, defacement, or forced administrative actions via cross-origin requests within the browser.

No verified public proof-of-concept code is available. Refer to the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-31864

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored within beam-me-up-scotty plugin option rows in the wp_options table.
Outbound browser requests from administrative sessions to unfamiliar domains shortly after loading pages that render the plugin's output.
Newly created WordPress administrator accounts or unexpected changes to user roles following visits to plugin-affected pages.

Detection Strategies

Audit the wp_options table for entries owned by the plugin and flag values containing HTML tags, event handlers, or encoded script markers.
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution originating from plugin-rendered pages.
Correlate WordPress audit logs with browser-side telemetry to identify script execution tied to administrative user sessions.

Monitoring Recommendations

Enable a WordPress activity log to track plugin setting changes and identify the account that introduced the payload.
Monitor web server access logs for administrative POST requests to admin.php or options.php targeting beam-me-up-scotty endpoints.
Alert on anomalous cookie or credential exfiltration patterns from browsers accessing the affected site.

How to Mitigate CVE-2025-31864

Immediate Actions Required

Update the beam-me-up-scotty plugin to a version later than 1.0.23 as soon as a patched release is available from the vendor.
If no patched version exists, deactivate and remove the plugin until a fix is published.
Rotate credentials and invalidate active sessions for all WordPress administrator accounts on affected sites.
Inspect and sanitize existing plugin settings in the database to remove any injected script content.

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack lists versions through 1.0.23 as affected. Consult the Patchstack XSS Vulnerability Report for the current patched version and vendor guidance.

Workarounds

Restrict administrator role assignment to a minimal set of trusted accounts and enforce multi-factor authentication.
Deploy a Web Application Firewall (WAF) rule to block script-like payloads submitted to plugin settings endpoints.
Apply a strict Content Security Policy that disallows inline scripts on pages rendering plugin output.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate beam-me-up-scotty
wp plugin delete beam-me-up-scotty