CVE-2025-32136: ActiveCampaign Stored XSS Vulnerability

CVE-2025-32136 Overview

CVE-2025-32136 is a stored cross-site scripting (XSS) vulnerability in the ActiveCampaign Subscription Forms plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. It affects all plugin versions up to and including 8.1.16. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who interact with the affected pages. Because the script executes in the context of the site, exploitation can lead to session theft, account takeover, or further compromise of the WordPress environment.

Critical Impact
Stored XSS allows attackers to persist malicious JavaScript in site content, affecting administrators and visitors who load the compromised pages.

Affected Products

ActiveCampaign Subscription Forms plugin for WordPress
All versions from n/a through 8.1.16
WordPress sites using the activecampaign-subscription-forms plugin

Discovery Timeline

2025-04-04 - CVE-2025-32136 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32136

Vulnerability Analysis

The vulnerability is a stored cross-site scripting weakness in the activecampaign-subscription-forms WordPress plugin. Input submitted through plugin-managed fields is written to persistent storage without proper sanitization or output encoding. When the stored content is rendered in a web page, the browser interprets the attacker-controlled payload as executable script.

Stored XSS differs from reflected XSS because the payload persists in the application. Every subsequent request that renders the affected content triggers execution. In the context of a WordPress plugin that handles subscription form configuration, this often means scripts run inside administrative views, broadening the blast radius.

Successful exploitation can lead to administrative session hijacking, forced actions through the WordPress REST API, redirection to attacker-controlled infrastructure, or injection of additional malicious payloads into site content.

Root Cause

The root cause is missing or insufficient input neutralization in plugin code paths that accept administrator-supplied values and later emit them into HTML output. The plugin does not consistently apply WordPress sanitization helpers such as sanitize_text_field() on input or escaping helpers such as esc_html(), esc_attr(), or wp_kses() on output.

Attack Vector

Exploitation requires an authenticated user with high privileges and some user interaction to trigger the stored payload. The attacker submits a crafted payload through a vulnerable plugin field. The payload is stored, then executed in the context of any user who loads the affected rendered page. Because the scope is changed, the resulting script executes with the privileges of the viewing user, including administrators.

No verified proof-of-concept code has been published. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32136

Indicators of Compromise

Unexpected <script> tags, event handler attributes (onerror, onload), or javascript: URIs stored in wp_options, wp_postmeta, or plugin-specific database tables
Outbound requests from administrator browsers to unfamiliar domains shortly after accessing the plugin's pages
New or modified WordPress administrator accounts created without a corresponding authorized action

Detection Strategies

Query the WordPress database for plugin-stored values containing HTML or script syntax and review manually
Monitor web server access logs for POST requests to admin.php or admin-ajax.php endpoints associated with the activecampaign-subscription-forms plugin that contain encoded script markers
Deploy a web application firewall ruleset that inspects form submissions for common XSS signatures before they reach WordPress

Monitoring Recommendations

Enable WordPress audit logging to track plugin configuration changes and user role modifications
Alert on anomalous administrative session activity, such as logins from new geolocations or user agents
Review Content Security Policy (CSP) violation reports for inline script execution attempts on administrative pages

How to Mitigate CVE-2025-32136

Immediate Actions Required

Update the ActiveCampaign Subscription Forms plugin to a version later than 8.1.16 as soon as the vendor publishes a fixed release
Audit all stored plugin configuration values for existing malicious payloads and remove them
Rotate credentials and invalidate active sessions for any WordPress administrator account that accessed the plugin while a vulnerable version was installed

Patch Information

The vulnerability affects ActiveCampaign Subscription Forms versions through 8.1.16. Monitor the Patchstack advisory and the WordPress plugin repository for the fixed version and apply updates through the WordPress admin dashboard or wp-cli.

Workarounds

Deactivate the activecampaign-subscription-forms plugin until a patched version is installed
Restrict administrative access to trusted IP ranges at the web server or WAF layer
Enforce a strict Content Security Policy that blocks inline scripts on /wp-admin/ pages to reduce XSS impact

bash

# Update the plugin via wp-cli once a fixed version is available
wp plugin update activecampaign-subscription-forms

# Or deactivate the plugin as an interim workaround
wp plugin deactivate activecampaign-subscription-forms