CVE-2025-46469 Overview
CVE-2025-46469 is a stored Cross-Site Scripting (XSS) vulnerability in the Benjamin Buddle Send From WordPress plugin. The flaw affects all versions up to and including 2.2. It stems from improper neutralization of user-supplied input during web page generation, categorized under [CWE-79]. An authenticated attacker with high privileges can inject malicious script content that persists on the server and executes in the browsers of other users who view the affected pages.
Critical Impact
Stored script injection enables session compromise, credential theft, and administrative action on behalf of victim users across the WordPress site.
Affected Products
- Benjamin Buddle Send From plugin for WordPress
- All versions from initial release through 2.2
- WordPress sites where the plugin is installed and active
Discovery Timeline
- 2025-04-24 - CVE CVE-2025-46469 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46469
Vulnerability Analysis
The Send From plugin fails to sanitize or encode user-supplied input before rendering it inside HTML output. An attacker with high-privilege access submits crafted payloads containing HTML or JavaScript through plugin configuration fields. The plugin stores this input and later reflects it into web pages without proper output encoding.
When an administrator or another user loads a page containing the stored payload, the browser executes the injected script within the site's origin. This grants the attacker access to session cookies, DOM content, and any privileged actions the victim can perform.
The vulnerability requires user interaction to trigger execution. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's security boundary, such as other authenticated sessions within the WordPress admin interface.
Root Cause
The root cause is missing input validation and output encoding in fields exposed by the Send From plugin. Input is stored verbatim in the WordPress database and inserted into HTML contexts without escaping through functions such as esc_html(), esc_attr(), or wp_kses(). This allows arbitrary HTML tags and event handlers to reach the rendered page.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated account with high privileges. The attacker submits payloads into the plugin's configurable input fields. The payload persists until an administrator or another user opens a page that renders the stored value.
See the Patchstack advisory for the Send From plugin for additional technical detail on the affected fields and payload behavior.
Detection Methods for CVE-2025-46469
Indicators of Compromise
- Plugin configuration entries or option values containing <script> tags, on* event handlers, or javascript: URIs
- Unexpected outbound requests from administrator browsers to attacker-controlled domains following visits to plugin-related admin pages
- WordPress audit log entries showing modification of Send From plugin settings by non-standard accounts
Detection Strategies
- Scan the wp_options table and plugin-specific storage for HTML or JavaScript content in fields expected to hold plain text
- Monitor HTTP response bodies served from WordPress admin pages for unescaped script content originating from plugin fields
- Review web server access logs for POST requests to plugin configuration endpoints containing encoded script payloads
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture changes to plugin settings and identify the accounts making them
- Deploy a Content Security Policy (CSP) that reports inline script violations from the WordPress admin origin
- Alert on administrator sessions initiating unexpected API calls, cookie access, or form submissions immediately after loading plugin pages
How to Mitigate CVE-2025-46469
Immediate Actions Required
- Deactivate the Send From plugin on all WordPress sites until a fixed version is confirmed available
- Audit all high-privilege WordPress accounts and revoke unused administrator or editor access
- Inspect plugin configuration fields for stored HTML or script content and remove any suspicious payloads
Patch Information
At the time of publication, the Patchstack advisory lists the vulnerability as affecting versions up to and including 2.2. Administrators should consult the plugin's WordPress.org listing for a fixed release and apply updates as soon as a patched version becomes available.
Workarounds
- Remove or deactivate the Send From plugin until a patched release is installed
- Restrict administrative access to trusted IP ranges through web server or WAF rules to reduce exposure of privileged accounts
- Deploy a Web Application Firewall rule that blocks HTML and JavaScript payloads in POST requests targeting the plugin's configuration endpoints
- Enforce a strict Content Security Policy on the WordPress admin interface to limit execution of inline scripts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.