CVE-2025-32175: VK Filter Search Stored XSS Vulnerability

CVE-2025-32175 Overview

CVE-2025-32175 is a stored cross-site scripting (XSS) vulnerability in the Vektor, Inc. VK Filter Search plugin for WordPress. The flaw affects all versions of the vk-filter-search plugin up to and including 2.20.2. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Authenticated attackers with low privileges can inject malicious scripts that persist in the application and execute in the browsers of other users who view the affected pages.

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized actions on behalf of authenticated WordPress users, including administrators who visit pages containing the injected payload.

Affected Products

Vektor, Inc. VK Filter Search plugin for WordPress
All versions from n/a through <= 2.20.2
WordPress sites with the vk-filter-search plugin installed and active

Discovery Timeline

2025-04-04 - CVE-2025-32175 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32175

Vulnerability Analysis

The VK Filter Search plugin fails to properly sanitize and encode user-supplied input before storing it and rendering it back in generated web pages. When an authenticated user submits data through a vulnerable input field, the plugin stores the raw payload without adequate neutralization of HTML and JavaScript constructs. When another user later loads a page that includes this stored data, the browser interprets and executes the injected script in the context of the site's origin.

Stored XSS is more impactful than reflected XSS because the payload persists on the server. Every subsequent visitor to the affected page executes the attacker's script without any additional interaction, expanding the blast radius beyond a single crafted URL. The CVSS vector indicates the scope changes, meaning the vulnerable component can affect resources beyond its own security scope, such as browser sessions of administrators.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress sanitization functions such as sanitize_text_field(), wp_kses(), or context-appropriate escaping helpers like esc_html(), esc_attr(), and esc_js() when rendering stored input. This allows raw <script> tags and event handler attributes to reach the DOM.

Attack Vector

Exploitation requires network access to the WordPress instance and low-privilege authentication. The attacker submits a crafted payload containing JavaScript through a plugin input surface that stores the value. User interaction is required for the payload to trigger, meaning a victim must load a page that includes the stored malicious content. Once triggered, the script runs with the privileges of the viewing user, enabling cookie theft, forced administrative actions, or redirection to attacker-controlled infrastructure.

The vulnerability is described in prose only, as no verified public proof-of-concept code is available. Refer to the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32175

Indicators of Compromise

Unexpected <script> tags, onerror=, onload=, or javascript: URIs stored in WordPress database tables associated with VK Filter Search
Outbound requests from browser sessions to unknown domains after visiting pages that render plugin-controlled content
Creation of new administrator accounts or unexpected changes to WordPress options following visits by privileged users
Web server access logs showing POST requests to plugin endpoints containing encoded HTML or JavaScript payloads

Detection Strategies

Query the WordPress wp_posts, wp_postmeta, and wp_options tables for content stored by the vk-filter-search plugin that contains script tags or JavaScript event handlers
Deploy Content Security Policy (CSP) reporting to identify script execution from unexpected sources
Review web application firewall (WAF) logs for XSS payload patterns targeting plugin URLs
Correlate authenticated user activity with sudden privilege changes or session anomalies

Monitoring Recommendations

Monitor WordPress plugin version inventory and flag installations at or below version 2.20.2
Alert on new or modified plugin content submissions from low-privileged accounts
Track administrative session activity following visits to pages rendered by VK Filter Search
Enable audit logging for changes to user roles, options, and installed plugins

How to Mitigate CVE-2025-32175

Immediate Actions Required

Identify all WordPress instances running the vk-filter-search plugin at version 2.20.2 or earlier
Update the plugin to a version released after 2.20.2 that addresses the vulnerability, once available from the vendor
Audit stored plugin data for injected scripts and remove any malicious content discovered
Rotate credentials and invalidate active sessions for any administrator who may have loaded affected pages

Patch Information

Refer to the Patchstack advisory for the current fixed version. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI. Verify plugin integrity after the update completes.

Workarounds

Deactivate and remove the VK Filter Search plugin until a patched version is installed
Restrict plugin-related input capabilities to trusted users only by reviewing role assignments
Deploy a WordPress-aware WAF with rules that block common XSS payload patterns on plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Configuration example: identify and disable the plugin via WP-CLI
wp plugin list --name=vk-filter-search --fields=name,status,version
wp plugin deactivate vk-filter-search
wp plugin update vk-filter-search