CVE-2025-46518: IGIT Related Posts Plugin XSS Vulnerability

CVE-2025-46518 is a stored cross-site scripting vulnerability in the IGIT Related Posts With Thumb Image After Posts WordPress plugin that allows attackers to inject malicious scripts. This article covers technical details, affected versions through 4.5.3, security impact, and recommended mitigation strategies.

CVE-2025-46518 Overview

CVE-2025-46518 is a stored Cross-Site Scripting (XSS) vulnerability in the phpaddicted IGIT Related Posts With Thumb Image After Posts WordPress plugin. The flaw affects all versions up to and including 4.5.3. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the database and executes in the browsers of other users who view affected pages. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation. Because the injected payload crosses a security scope, it can impact site visitors and administrators, enabling session theft, content manipulation, or forced administrative actions.

Critical Impact
Authenticated low-privilege users can persist JavaScript in WordPress pages, targeting visitors and administrators through stored payloads.

Affected Products

IGIT Related Posts With Thumb Image After Posts WordPress plugin (all versions through 4.5.3)
WordPress sites running the igit-related-posts-with-thumb-images-after-posts plugin by phpaddicted
Any site rendering plugin-controlled output to authenticated or unauthenticated visitors

Discovery Timeline

2025-05-23 - CVE-2025-46518 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46518

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79]. The plugin fails to properly neutralize user-supplied input before writing it into pages generated by WordPress. Because the payload is stored server-side, every subsequent page render delivers the malicious script to viewers. Exploitation requires authentication with low privileges and user interaction, such as an administrator visiting a page that renders plugin output. The scope change means script execution occurs in a browser context that trusts the WordPress origin, enabling actions on behalf of the victim within that domain.

Root Cause

The plugin does not apply adequate output encoding or input sanitization for fields it renders back into HTML. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses_post() for safe output handling, but the affected code paths in versions through 4.5.3 do not consistently apply them. As a result, attacker-controlled data reaches the DOM as executable script.

Attack Vector

The attack is delivered over the network by an authenticated user with contributor-level or similar low privileges. The attacker submits crafted input containing HTML or JavaScript through a plugin-controlled field. The payload is persisted and later rendered when another user, typically an administrator or site visitor, loads a page that includes the affected plugin output. Refer to the Patchstack XSS Vulnerability Report for advisory details.

No verified public proof-of-concept code is available. The vulnerability class is well documented: attacker input containing <script> tags or event handler attributes is stored without neutralization and executed in the victim's session context on render.

Detection Methods for CVE-2025-46518

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs in plugin-generated content stored in the wp_posts or wp_options tables.
Outbound requests from administrator browsers to unfamiliar third-party domains shortly after loading pages containing related-posts widgets.
New or modified WordPress administrator accounts created without a corresponding legitimate administrator action.

Detection Strategies

Audit plugin configuration values and post metadata for HTML markup that should not be present in text fields.
Enforce a Content Security Policy (CSP) in report-only mode and review violations for injection attempts against WordPress endpoints.
Review web server access logs for POST requests to plugin administrative endpoints from low-privilege user sessions.

Monitoring Recommendations

Monitor WordPress audit logs for content edits made by contributor or author accounts that include HTML or script fragments.
Alert on administrator sessions that trigger unusual XHR or fetch calls to external hosts.
Track installations of the igit-related-posts-with-thumb-images-after-posts plugin across managed sites and flag versions 4.5.3 and earlier.

How to Mitigate CVE-2025-46518

Immediate Actions Required

Identify all WordPress sites running the IGIT Related Posts With Thumb Image After Posts plugin at version 4.5.3 or earlier.
Deactivate the plugin until a patched release is verified and applied.
Rotate credentials and session tokens for administrator accounts that visited pages rendering plugin output.

Patch Information

At the time of publication, the advisory identifies affected versions as n/a through <= 4.5.3. Site operators should consult the Patchstack advisory for the latest fixed version information and upgrade when a patched release is published.

Workarounds

Deactivate and remove the plugin if a patched version is not yet available.
Restrict contributor, author, and editor roles to trusted users only, limiting who can supply input to plugin fields.
Deploy a web application firewall rule that blocks HTML and script payloads in requests to plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts to reduce impact of stored payloads.

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate igit-related-posts-with-thumb-images-after-posts
wp plugin delete igit-related-posts-with-thumb-images-after-posts