CVE-2025-32680: Review Stream Stored XSS Vulnerability

CVE-2025-32680 Overview

CVE-2025-32680 is a stored Cross-Site Scripting (XSS) vulnerability in the Grade Us, Inc. Review Stream plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers with high-privileged access can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The issue affects all Review Stream versions up to and including 1.6.7. Successful exploitation can lead to session compromise, unauthorized actions performed on behalf of victims, and defacement of rendered content.

Critical Impact
Stored XSS enables persistent JavaScript execution in visitor browsers, facilitating session theft and unauthorized administrative actions within the WordPress environment.

Affected Products

Grade Us, Inc. Review Stream WordPress plugin
All versions from initial release through 1.6.7
WordPress sites embedding Review Stream review widgets

Discovery Timeline

2025-04-09 - CVE-2025-32680 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32680

Vulnerability Analysis

The Review Stream plugin fails to sanitize and encode user-controlled input before rendering it inside HTML output. An authenticated user with sufficient plugin privileges can submit crafted content containing HTML or JavaScript. The plugin stores this input in the WordPress database and later reflects it into pages served to other users. Because the payload persists, every visitor loading the affected view executes attacker-controlled script in the site's origin.

The attack requires user interaction and elevated privileges, but the scope is changed. This means the injected script executes in a security context beyond the vulnerable component, affecting other users of the WordPress site. Exploitation can lead to administrator session hijacking, forced navigation, phishing overlays, or plugin/theme modification through authenticated AJAX endpoints.

Root Cause

The root cause is missing output encoding and input validation on fields processed by the Review Stream plugin. WordPress provides helper functions such as esc_html(), esc_attr(), and wp_kses() for safe rendering. The plugin either omits these calls or applies insufficient filters on the sink where review content is emitted into the DOM.

Attack Vector

An attacker with authenticated access submits review or configuration content that contains a JavaScript payload embedded in HTML attributes or tags. The payload is written to the database without neutralization. When an administrator or site visitor loads a page rendering the stored review, the browser parses and executes the script. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-32680

Indicators of Compromise

Review Stream database entries containing <script>, onerror=, onload=, or javascript: strings
Unexpected outbound requests from browsers loading pages that render Review Stream content
New or modified WordPress administrator accounts following exposure of a vulnerable page
Unusual wp-admin AJAX activity originating from administrator sessions

Detection Strategies

Audit the wp_posts, wp_postmeta, and plugin-specific tables for HTML tags or event handlers in Review Stream fields
Enable Content Security Policy (CSP) reporting to surface inline script violations on pages that embed review widgets
Inspect web server access logs for POST requests to Review Stream endpoints containing encoded angle brackets or script keywords

Monitoring Recommendations

Alert on the creation of WordPress users with elevated roles outside change-management windows
Monitor plugin file integrity and detect changes to Review Stream PHP or JavaScript assets
Correlate administrator login events with subsequent access to pages known to render user-submitted reviews

How to Mitigate CVE-2025-32680

Immediate Actions Required

Update the Review Stream plugin to a version later than 1.6.7 once released by Grade Us, Inc.
Restrict which authenticated roles can submit or edit review content until a patched version is deployed
Review all existing Review Stream entries and remove any containing script tags or event handler attributes
Rotate credentials and session tokens for administrator accounts that may have loaded exploited pages

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and vendor guidance. Apply the fixed version as soon as it becomes available through the WordPress plugin repository.

Workarounds

Temporarily deactivate the Review Stream plugin if a fixed version is not yet available
Enforce a strict Content Security Policy that blocks inline scripts on pages rendering review widgets
Place a Web Application Firewall (WAF) rule in front of WordPress to filter POST payloads containing script tags targeting Review Stream endpoints

bash

# Example ModSecurity rule to block script payloads on Review Stream endpoints
SecRule REQUEST_URI "@contains review-stream" \
    "phase:2,deny,status:403,id:1032680,\
    msg:'Blocked potential XSS payload targeting Review Stream',\
    chain"
    SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"