CVE-2025-39575: WPCasa WordPress Plugin Stored XSS Vulnerability

CVE-2025-39575 Overview

CVE-2025-39575 is a stored Cross-Site Scripting (XSS) vulnerability in the WPSight WPCasa WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers with low-privilege authenticated access can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The vulnerability affects WPCasa versions up to and including 1.3.2.

Because the payload is stored server-side, exploitation occurs whenever a victim renders the affected content. The scope change reflected in the CVSS vector indicates that injected scripts can impact resources beyond the vulnerable component, including administrator sessions.

Critical Impact
Authenticated attackers can inject persistent JavaScript into WPCasa pages, enabling session hijacking, credential theft, and administrative account takeover through victim browser execution.

Affected Products

WPSight WPCasa WordPress plugin versions up to and including 1.3.2
WordPress sites running vulnerable WPCasa installations
Any user or administrator viewing content generated by the affected plugin

Discovery Timeline

2025-04-16 - CVE-2025-39575 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39575

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WPCasa real estate plugin for WordPress. WPCasa fails to properly sanitize and escape user-controlled input before storing it and rendering it back within generated web pages. This category of flaw is tracked under [CWE-79], covering improper neutralization of input during web page generation.

Exploitation requires an authenticated user with low privileges and involves user interaction, typically loading a page that renders the injected content. The scope changes upon exploitation, meaning the injected script executes in a security context different from the vulnerable component. This condition is particularly relevant for administrator sessions viewing content submitted by lower-privileged users.

Root Cause

The root cause is missing or inadequate output encoding when the plugin renders stored user input in HTML contexts. WordPress plugins are expected to use functions such as esc_html(), esc_attr(), and wp_kses_post() to neutralize control characters before emitting them into a response. WPCasa did not consistently apply these safeguards through version 1.3.2, allowing raw <script> tags and event handler attributes to persist in stored data and reach the DOM intact.

Attack Vector

An authenticated attacker submits crafted input through a WPCasa form field or listing property that the plugin later renders on a public or administrative page. When a victim, including a site administrator, loads the affected page, the browser parses and executes the injected script. Payloads commonly target session cookies, WordPress nonces, or perform silent HTTP requests to plugin and admin endpoints on behalf of the victim.

Refer to the Patchstack advisory for wpcasa for additional technical context.

Detection Methods for CVE-2025-39575

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers (onerror, onload, onclick) stored in WPCasa post metadata or database tables
Outbound HTTP requests from browser sessions to attacker-controlled domains immediately after loading WPCasa listing pages
New or modified administrator accounts, plugins, or theme files created shortly after administrator visits to WPCasa content
WordPress audit log entries showing privileged actions from unexpected IP addresses or user agents

Detection Strategies

Query the WordPress wp_postmeta and plugin-specific tables for stored values containing HTML tags, script fragments, or encoded payloads
Enable a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from WPCasa pages
Review web server access logs for POST requests to WPCasa submission endpoints followed by GET requests from administrator IP ranges

Monitoring Recommendations

Monitor WordPress administrative sessions for anomalous XHR or fetch activity to /wp-admin/admin-ajax.php and REST API endpoints
Alert on plugin, theme, or user account modifications that correlate with WPCasa page views
Ingest WordPress and web server logs into a centralized analytics platform to correlate submission, rendering, and privileged action events

How to Mitigate CVE-2025-39575

Immediate Actions Required

Update the WPCasa plugin to a version later than 1.3.2 as soon as a patched release is available from WPSight
Audit stored WPCasa content for injected HTML, script tags, and event handler attributes and remove any malicious entries
Rotate WordPress administrator passwords and invalidate active sessions if administrators viewed potentially tainted content

Patch Information

WPSight addresses the vulnerability in releases after WPCasa 1.3.2. Administrators should consult the Patchstack vulnerability entry for WPCasa for the current fixed version and apply updates through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate the WPCasa plugin until a patched release can be installed and validated in a staging environment
Deploy a Web Application Firewall (WAF) rule set that blocks XSS payloads targeting WPCasa submission endpoints
Restrict WPCasa content submission privileges to trusted user roles only and enforce moderation before publication
Implement a strict Content Security Policy that disallows inline scripts and untrusted external script sources

bash

# Update WPCasa via WP-CLI once a patched release is published
wp plugin update wpcasa --path=/var/www/html

# Temporarily deactivate the plugin if no patch is available
wp plugin deactivate wpcasa --path=/var/www/html

# Example CSP header to add via web server configuration
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"