CVE-2025-32130: Posts Footer Manager Stored XSS Vulnerability

CVE-2025-32130 Overview

CVE-2025-32130 is a stored Cross-Site Scripting (XSS) vulnerability in the Data443 Risk Mitigation Posts Footer Manager plugin for WordPress. The flaw affects the intelly-posts-footer-manager plugin in all versions up to and including 2.2.0. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Stored payloads execute in the browser sessions of users who view affected pages, enabling session theft, content manipulation, and redirection to malicious sites. The issue is tracked under CWE-79 and requires user interaction to trigger the injected script.

Critical Impact

An authenticated attacker can inject persistent JavaScript into plugin-managed footer content, executing arbitrary script in the browsers of site visitors and administrators.

Affected Products

• Data443 Risk Mitigation Posts Footer Manager plugin for WordPress
• Plugin slug intelly-posts-footer-manager
• All versions from n/a through 2.2.0

Discovery Timeline

• 2025-04-04 - CVE-2025-32130 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32130

Vulnerability Analysis

The vulnerability resides in how the Posts Footer Manager plugin handles input supplied to plugin-managed footer content. The plugin renders that content into pages without adequate output encoding or input sanitization. An attacker with privileged access, typically a contributor-level account or higher, submits a footer entry containing HTML or JavaScript. WordPress stores the payload in the database and echoes it into rendered posts. When a visitor loads an affected post, the browser parses and executes the payload in the site's origin context. Because the scope metric indicates a security scope change, the impact extends beyond the vulnerable component to the browsers of any user viewing the injected content.

Root Cause

The root cause is missing or insufficient neutralization of untrusted input passed to the plugin's footer rendering routine. WordPress provides sanitization helpers such as wp_kses_post() and escaping functions such as esc_html() and esc_attr(). When these functions are omitted, tags such as <script> and event-handler attributes such as onerror persist through storage and reach the DOM intact.

Attack Vector

Exploitation requires an authenticated session with elevated privileges and one victim interaction, such as loading a page containing the injected footer. The attacker submits crafted content through the plugin's administrative interface, waits for the payload to render on a public or administrative view, and captures cookies or performs actions in the victim's context. Refer to the Patchstack Vulnerability Report for technical disclosure details.

Detection Methods for CVE-2025-32130

Indicators of Compromise

• Presence of <script> tags, javascript: URIs, or event-handler attributes such as onerror and onload inside footer records created by the intelly-posts-footer-manager plugin.
• Outbound HTTP requests from visitor browsers to unfamiliar domains after loading posts on the affected site.
• Unexpected administrator account creation, plugin installation, or privilege changes originating from admin browsers that viewed injected pages.

Detection Strategies

• Query the WordPress database for plugin-managed footer records containing HTML tags, script keywords, or encoded payload patterns such as %3Cscript%3E.
• Review web server access logs for authenticated POST requests to plugin administrative endpoints followed by anomalous outbound requests from client browsers.
• Use a web application firewall or content security policy report endpoint to surface script executions from unexpected origins.

Monitoring Recommendations

• Monitor WordPress wp-admin activity for privilege changes and plugin configuration edits by contributor or editor accounts.
• Enable audit logging plugins to track changes to plugin settings and post metadata associated with intelly-posts-footer-manager.
• Alert on new inbound admin sessions from unfamiliar IP addresses or user agents.

How to Mitigate CVE-2025-32130

Immediate Actions Required

• Deactivate the Posts Footer Manager plugin until a patched version is confirmed available and deployed.
• Audit all footer entries created through the plugin and remove any content containing script tags or event handlers.
• Rotate credentials for administrator and editor accounts that may have interacted with injected content.

Patch Information

At the time of publication, the vendor advisory lists all versions through 2.2.0 as affected. Consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for the current fixed release. Upgrade to the latest available version once the vendor publishes a patched build.

Workarounds

• Restrict user roles able to publish or edit posts and plugin content, limiting the pool of accounts capable of injecting payloads.
• Deploy a Content Security Policy header that blocks inline scripts and restricts allowed script sources.
• Use a web application firewall rule to strip or block script tags in requests targeting the plugin's administrative endpoints.

# Example Content Security Policy header for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"