CVE-2025-4369 Overview
CVE-2025-4369 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Companion Auto Update plugin for WordPress. The flaw affects all versions up to and including 3.9.2. It stems from insufficient input sanitization and output escaping on the update_delay_days parameter in the plugin's admin dashboard. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute when other users view the affected pages. The vulnerability only impacts multi-site installations and installations where unfiltered_html has been disabled.
Critical Impact
An authenticated administrator on a multi-site WordPress network can inject persistent JavaScript that executes in the browsers of other users, including super administrators.
Affected Products
- Companion Auto Update plugin for WordPress, versions up to and including 3.9.2
- WordPress multi-site installations running the vulnerable plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2025-07-15 - CVE-2025-4369 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-4369
Vulnerability Analysis
The Companion Auto Update plugin exposes an administrative setting named update_delay_days on its dashboard page. The plugin stores the submitted value without adequate sanitization and later renders it back into the admin interface without proper output escaping. An attacker who controls an administrator account, or who has compromised one, can persist a malicious payload in the plugin's stored options. That payload executes in any authenticated session that renders the affected dashboard page.
Because the injection point sits inside the WordPress admin interface, executed scripts run in a privileged browser context. Attackers can pivot to actions such as creating new administrator accounts, planting backdoors in themes or plugins, or exfiltrating session cookies.
Root Cause
The underlying weakness is missing input validation on write and missing output escaping on read for the update_delay_days parameter handled in admin/dashboard.php. See the WordPress Plugin Code Reference for the vulnerable code path and the WordPress ChangeSet Update for the corrective commit.
Attack Vector
Exploitation requires an authenticated user with administrator privileges. The attacker submits a crafted value containing HTML or JavaScript through the plugin's settings form. The malicious value is stored in the WordPress options table and rendered on subsequent visits to the dashboard. The scope constraint to multi-site or unfiltered_html-disabled installations reflects the fact that unrestricted administrators on standard single-site installs may already inject HTML through legitimate features. Full technical details are available in the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-4369
Indicators of Compromise
- Unexpected <script> tags, event handlers, or encoded JavaScript stored in the update_delay_days option within the wp_options table.
- Creation of unfamiliar administrator accounts or new plugin or theme files shortly after admin logins to a site running Companion Auto Update.
- Outbound requests from admin browsers to unknown domains after loading the plugin's dashboard page.
Detection Strategies
- Query the wp_options table for the plugin's stored settings and inspect update_delay_days for HTML or script content.
- Review WordPress audit logs for changes to Companion Auto Update settings by administrators.
- Deploy web application firewall rules that inspect POST bodies to the plugin's admin page for script payloads.
Monitoring Recommendations
- Alert on modifications to plugin option rows on multi-site WordPress networks.
- Monitor administrator login sessions for anomalous JavaScript-driven actions such as user creation or file edits.
- Track version inventory of the Companion Auto Update plugin across managed WordPress hosts.
How to Mitigate CVE-2025-4369
Immediate Actions Required
- Update the Companion Auto Update plugin to the version released in changeset 3325878, which supersedes 3.9.2.
- Audit the wp_options table on affected sites and remove any script content stored in update_delay_days.
- Review administrator accounts and rotate credentials for any accounts that accessed the plugin dashboard during the exposure window.
Patch Information
The plugin maintainers addressed the vulnerability in the release following 3.9.2. Verify remediation by comparing the installed plugin files against the fixed release referenced in the Companion Auto-Update Developer Info page. Confirm that admin/dashboard.php applies escaping functions such as esc_attr() when rendering the update_delay_days value.
Workarounds
- Restrict administrator accounts on multi-site WordPress installations to trusted personnel until the plugin is updated.
- Deactivate the Companion Auto Update plugin on multi-site networks that cannot be patched immediately.
- Re-enable the unfiltered_html capability only where the risk model justifies broad HTML injection by administrators, understanding this bypasses the vulnerability's scope condition rather than fixing it.
# Configuration example: inspect stored option for injected script content
wp option get cau_settings --format=json | jq '.update_delay_days'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
