CVE-2025-46233: Sirv CDN Stored XSS Vulnerability

CVE-2025-46233 Overview

CVE-2025-46233 is a stored cross-site scripting (XSS) vulnerability in the Sirv CDN and Image Hosting plugin for WordPress. The flaw affects all versions of the plugin up to and including 7.5.3. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The issue is classified under CWE-79 for improper neutralization of input during web page generation.

Critical Impact
An authenticated contributor-level user can inject stored JavaScript that executes in administrator sessions, enabling session theft, forced administrative actions, and further compromise of the WordPress site.

Affected Products

Sirv CDN and Image Hosting plugin for WordPress
All versions from initial release through 7.5.3
WordPress sites using the sirv plugin (CPE: cpe:2.3:a:sirv:sirv:*:*:*:*:*:wordpress:*:*)

Discovery Timeline

2025-04-22 - CVE-2025-46233 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46233

Vulnerability Analysis

The Sirv plugin fails to properly neutralize user-supplied input before rendering it within HTML output generated by the plugin. This allows an attacker with low-privileged authenticated access to persist attacker-controlled markup or script content in the WordPress database. When another user, typically an administrator or editor, views a page or admin screen that renders the tainted content, the injected JavaScript executes in the victim's browser context.

Because the payload is stored rather than reflected, exploitation does not require the attacker to lure the victim to a crafted URL each time. The attack requires user interaction to trigger execution, and the vulnerability crosses a security boundary, meaning script execution occurs in a context different from the injection point.

Root Cause

The root cause is missing or insufficient output encoding on plugin-controlled fields. Input accepted through plugin forms or configuration inputs is written back into HTML pages without escaping HTML control characters such as <, >, and quote marks. This lets an authenticated user store a payload like <script>...</script> or event-handler attributes that browsers subsequently parse and execute.

Attack Vector

Exploitation proceeds over the network against the WordPress admin surface. An attacker with an authenticated low-privilege account submits crafted input through a plugin field vulnerable to stored XSS. The payload persists in the database. When a privileged user later loads the affected view, the browser executes the script under the site's origin.

Refer to the Patchstack WordPress Vulnerability Advisory for advisory-level technical details. No public proof-of-concept exploit code is currently associated with this CVE.

Detection Methods for CVE-2025-46233

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in Sirv plugin configuration fields or post metadata
Outbound requests from administrator browsers to unknown external domains shortly after loading pages containing Sirv content
New administrator accounts or unexpected changes to user roles following administrator visits to plugin-managed pages

Detection Strategies

Review the WordPress wp_options, wp_postmeta, and Sirv-specific tables for HTML or script content that should not be present in text fields
Enable and monitor a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on admin pages
Correlate WordPress audit logs for content edits by low-privilege users with subsequent administrator activity on the same resource

Monitoring Recommendations

Log and alert on modifications to plugin settings and posts by contributor or author accounts
Monitor browser-side error reports and CSP violation reports from /wp-admin/ routes
Track HTTP responses containing Sirv plugin output for unexpected inline JavaScript before delivery to administrators

How to Mitigate CVE-2025-46233

Immediate Actions Required

Update the Sirv plugin to a version released after 7.5.3 that addresses the XSS flaw
Audit all Sirv plugin configuration fields and stored content for injected script payloads and remove any malicious entries
Rotate WordPress administrator credentials and invalidate active sessions if administrator accounts accessed affected pages while the plugin was vulnerable
Review recent activity from low-privilege accounts that had access to Sirv plugin functionality

Patch Information

The vulnerability affects Sirv plugin versions up to and including 7.5.3. Site administrators should upgrade to the latest patched release published by the vendor. Consult the Patchstack advisory for the fixed version number and vendor guidance.

Workarounds

Deactivate and remove the Sirv plugin until the site can be upgraded to a fixed version
Restrict contributor, author, and editor account creation, and enforce least privilege on any account able to interact with Sirv fields
Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in requests targeting Sirv plugin endpoints
Enforce a strict Content Security Policy on /wp-admin/ that disallows inline scripts to reduce the impact of stored payloads

bash

# Example: enforce a restrictive Content-Security-Policy header for wp-admin via Nginx
location /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;
}