CVE-2025-46238 Overview
CVE-2025-46238 is a stored Cross-Site Scripting (XSS) vulnerability in the rbaer List Last Changes WordPress plugin. The flaw affects all versions up to and including 1.2.1. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users visiting affected pages.
Critical Impact
An authenticated attacker can inject persistent scripts that execute in other users' browsers, leading to session theft, forced administrative actions, or redirection to attacker-controlled infrastructure.
Affected Products
- rbaer List Last Changes plugin for WordPress
- All versions from n/a through 1.2.1
- WordPress installations using the list-last-changes plugin
Discovery Timeline
- 2025-04-22 - CVE-2025-46238 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46238
Vulnerability Analysis
The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. It is categorized as a stored XSS, meaning malicious payloads are persisted server-side and served to any user who loads the affected page.
Exploitation requires an authenticated user with low privileges and some user interaction to trigger the injected payload. Because the scope changes when the vulnerability is exploited, injected scripts can affect components beyond the plugin's own trust boundary, including administrative sessions viewing plugin-managed content.
Successful exploitation can result in browser session hijacking, coerced administrative actions via forged requests, defacement of rendered content, or redirection to phishing and malware distribution pages.
Root Cause
The plugin does not sanitize or escape input supplied through plugin-controlled fields before rendering it into HTML output. Input that should be treated as data is instead interpreted by the browser as executable markup, permitting arbitrary JavaScript execution in the context of the WordPress site.
Attack Vector
The attack is network-based and requires an authenticated contributor-level or higher account depending on the plugin's capability checks. An attacker submits a crafted payload through an input handled by the plugin. The payload is stored and later rendered without proper output encoding, executing when a victim, including administrators, views the affected page.
No verified proof-of-concept code is publicly available. Refer to the Patchstack WordPress XSS Vulnerability advisory for additional technical context.
Detection Methods for CVE-2025-46238
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings stored in plugin-managed database fields
- Outbound browser requests from WordPress admin sessions to unfamiliar domains after loading pages rendered by list-last-changes
- New or modified WordPress administrator accounts created shortly after content updates involving the plugin
Detection Strategies
- Query the WordPress database for plugin-owned fields containing HTML tags or event handler attributes
- Inspect web server access logs for POST requests to plugin endpoints originating from low-privilege accounts
- Monitor rendered HTML output for script content that does not originate from the site's theme or trusted plugins
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) with XSS ruleset coverage in front of the WordPress instance
- Alert on WordPress plugin file changes and administrator role modifications
- Correlate authenticated user activity with subsequent administrator page views for suspicious sequences
How to Mitigate CVE-2025-46238
Immediate Actions Required
- Inventory WordPress sites and confirm whether list-last-changes version 1.2.1 or earlier is installed
- Disable or remove the plugin until a vendor-supplied patched version is confirmed available
- Rotate credentials and session cookies for administrator accounts that accessed affected pages
- Review plugin-managed content for injected script payloads and remove them
Patch Information
At the time of the NVD entry, versions up to and including 1.2.1 are affected. Monitor the Patchstack advisory and the WordPress plugin repository for a fixed release, and upgrade as soon as a patched version is published.
Workarounds
- Deactivate the list-last-changes plugin until an update is available
- Restrict contributor and author account creation and audit existing low-privilege users
- Deploy a WAF rule to block requests containing common XSS payload patterns targeting plugin endpoints
- Apply Content Security Policy (CSP) headers that restrict inline script execution on WordPress pages
# Example: disable the vulnerable plugin using WP-CLI
wp plugin deactivate list-last-changes
wp plugin delete list-last-changes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
