CVE-2025-4579: WordPress WP Content Security XSS Flaw

CVE-2025-4579 Overview

CVE-2025-4579 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the WP Content Security Policy plugin for WordPress. The flaw exists in all versions up to and including 2.3. The plugin fails to sanitize input and escape output for the blocked-uri and effective-directive parameters processed by the Content Security Policy (CSP) violation reporting endpoint. Unauthenticated attackers can inject arbitrary JavaScript that executes whenever an administrator or user views the affected pages in the WordPress admin interface. The vulnerability carries a CVSS 3.1 base score of 7.2 and has an EPSS probability of 0.876%, placing it in the 75th percentile for likelihood of exploitation.

Critical Impact
Unauthenticated remote attackers can store malicious JavaScript in the WordPress database through CSP violation reports, leading to session hijacking, administrator account takeover, and arbitrary actions executed in the context of viewers.

Affected Products

WP Content Security Policy plugin for WordPress — all versions through 2.3
WordPress sites with the wp-content-security-policy plugin enabled
Administrator dashboards rendering stored CSP violation report data

Discovery Timeline

2025-05-15 - CVE-2025-4579 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4579

Vulnerability Analysis

The WP Content Security Policy plugin implements a CSP violation reporting endpoint that receives JSON reports from browsers when a Content Security Policy directive is violated. These reports contain attacker-controllable fields, including blocked-uri and effective-directive. The plugin writes these values to persistent storage and later renders them in the WordPress administrative interface without applying proper sanitization or output escaping. Because the reporting endpoint accepts unauthenticated POST submissions by design, any remote actor can craft a violation report containing JavaScript payloads. When an administrator opens the report-viewing page, the injected script executes in the browser session of a privileged user.

Root Cause

The root cause is missing input sanitization on ingestion and missing output escaping on rendering. The vulnerable code paths are located in includes/WP_CSP.php at lines 597, 612, and 659, where the blocked-uri and effective-directive values are handled. The plugin does not apply WordPress functions such as esc_html(), esc_attr(), or wp_kses() before emitting these values in administrative views, allowing raw HTML and <script> tags to be rendered.

Attack Vector

An attacker constructs a CSP violation report containing an XSS payload in the blocked-uri or effective-directive field and submits it to the plugin's reporting URI on a target site. No authentication, no privileges, and no user interaction are required for storage. The payload persists until a privileged WordPress user views the violation report listing, at which point the script executes with the viewer's privileges. The scope is Changed because injected JavaScript executes in the WordPress administration security context, allowing impacts beyond the vulnerable component itself, including theft of authentication cookies, creation of rogue administrator accounts, and modification of site content.

No verified proof-of-concept code is publicly indexed in Exploit-DB. The Wordfence advisory documents the report ingestion flow and the unsanitized rendering in the admin interface.

Detection Methods for CVE-2025-4579

Indicators of Compromise

POST requests to the WP Content Security Policy plugin's violation report endpoint containing HTML or JavaScript tokens such as <script, onerror=, or javascript: inside the blocked-uri or effective-directive fields
Unexpected new WordPress administrator accounts or modifications to user roles following access to the CSP violation report admin page
Outbound requests from administrator browsers to attacker-controlled domains immediately after loading the plugin's reporting dashboard
Database rows in the plugin's CSP report tables containing raw HTML or script syntax in stored URI or directive columns

Detection Strategies

Inspect web server access logs for POST requests to the CSP report URI with payloads exceeding normal report size or containing angle brackets and event handlers
Run database queries against the plugin's storage tables to identify stored values containing <, >, or javascript: substrings
Deploy Web Application Firewall (WAF) rules that block HTML and script syntax inside JSON fields posted to CSP reporting endpoints

Monitoring Recommendations

Alert on WordPress administrator session creation from unusual IP addresses following access to plugin admin pages
Monitor outbound HTTP traffic from administrator workstations for connections initiated by browser sessions rather than user activity
Track plugin version inventories across managed WordPress sites and flag installations of wp-content-security-policy at version 2.3 or earlier

How to Mitigate CVE-2025-4579

Immediate Actions Required

Disable or remove the WP Content Security Policy plugin on any WordPress site running version 2.3 or earlier until a patched release is installed
Review the plugin's stored CSP violation reports for entries containing HTML or script syntax and purge malicious records
Audit WordPress user accounts for unauthorized administrators and reset credentials for all privileged users
Rotate WordPress authentication keys and salts in wp-config.php to invalidate any stolen session cookies

Patch Information

At the time of publication, the Wordfence Vulnerability Report documents the issue against versions up to and including 2.3. Site administrators should monitor the plugin's WordPress.org listing for a fixed release and apply it immediately upon availability. The vulnerable handlers are located in WP_CSP.php line 597, line 612, and line 659.

Workarounds

Block external access to the plugin's CSP violation reporting URI at the web server or WAF layer
Restrict access to the WordPress administrative dashboard by IP allowlist while the plugin remains installed
Configure a WAF rule to drop POST bodies to the report endpoint that contain <script, onerror, onload, or javascript: substrings
Deactivate the plugin and rely on a server-level CSP header configuration until a patched version is released

bash

# Example: block CSP violation report endpoint at nginx until patched
location ~* /wp-content-security-policy/.*report.*$ {
    deny all;
    return 403;
}

# Example: identify the affected plugin version on a managed host
wp plugin get wp-content-security-policy --field=version