CVE-2025-46521: WS Force Login Page Stored XSS Vulnerability

CVE-2025-46521 Overview

CVE-2025-46521 is a stored cross-site scripting (XSS) vulnerability in the Silver Muru WS Force Login Page WordPress plugin (ws-force-login-page). The flaw affects all versions up to and including 3.0.3 and stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected page. The vulnerability carries a changed scope, meaning the injected script can impact resources beyond the vulnerable component.

Critical Impact
Stored JavaScript payloads persist across sessions and execute in the context of any user rendering the compromised page, enabling session theft, forced actions, and administrative account takeover.

Affected Products

Silver Muru WS Force Login Page plugin for WordPress
All versions from initial release through 3.0.3
WordPress sites with the ws-force-login-page plugin installed and activated

Discovery Timeline

2025-04-24 - CVE-2025-46521 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46521

Vulnerability Analysis

The WS Force Login Page plugin fails to sanitize input written into page output. Attacker-controlled data reaches the rendered HTML without encoding, allowing arbitrary script content to be stored in the WordPress database and served to subsequent visitors. Because the vulnerability is stored rather than reflected, the payload triggers automatically whenever the affected view is loaded.

Exploitation requires an authenticated session with high privileges and a user interaction to trigger the injected payload. The scope change indicates that the executed script operates in a security context different from the vulnerable component, typically the WordPress administration interface or another authenticated user's session.

Root Cause

The root cause is missing or insufficient output encoding on data flowing from plugin settings or user-controllable fields into rendered HTML. The plugin does not apply WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses() before echoing values into the response body. This aligns with the CWE-79 classification for improper neutralization of input during web page generation.

Attack Vector

An attacker with elevated plugin permissions submits a payload containing HTML or JavaScript through a vulnerable input field. The payload is stored in the WordPress database. When an administrator or privileged user loads the page that renders that field, the browser parses and executes the injected script. Consequences include session cookie theft, forced administrative actions through the WordPress REST API, plugin or theme modification, and account creation with elevated roles.

Refer to the Patchstack WordPress Vulnerability Advisory for the vendor-tracked details.

Detection Methods for CVE-2025-46521

Indicators of Compromise

Unexpected <script>, <iframe>, or on* event-handler attributes stored in the wp_options table or plugin-specific options tied to ws-force-login-page.
New WordPress administrator accounts, altered user roles, or unauthorized plugin installations following administrator sessions.
Outbound requests from administrator browsers to unfamiliar domains immediately after loading login-related admin pages.

Detection Strategies

Audit plugin settings and stored option values for HTML or JavaScript content that should not be present.
Review WordPress access logs for POST requests to plugin configuration endpoints originating from privileged accounts.
Deploy a Web Application Firewall (WAF) rule set that inspects requests to wp-admin for XSS payload patterns targeting the ws-force-login-page plugin.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation to catch unauthorized changes to core files, plugins, and themes.
Log and alert on privileged user actions including new user creation, role changes, and plugin activation events.
Correlate administrator authentication events with subsequent configuration changes to identify anomalous post-login behavior.

How to Mitigate CVE-2025-46521

Immediate Actions Required

Identify all WordPress sites running the WS Force Login Page plugin at version 3.0.3 or earlier.
Deactivate and remove the plugin until a patched release is confirmed available from the vendor.
Rotate credentials for all administrator accounts and invalidate active WordPress sessions.
Review the site for unauthorized administrator accounts, unexpected plugins, and modified theme files.

Patch Information

At the time of the NVD entry, the advisory lists all versions through 3.0.3 as affected without a documented fixed version. Monitor the Patchstack WordPress Vulnerability Advisory and the plugin's official distribution channel for a patched release. Apply the patch immediately once published and verify the plugin version after upgrade.

Workarounds

Uninstall the ws-force-login-page plugin and replace it with an actively maintained alternative if forced-login functionality is required.
Restrict administrator access to trusted IP ranges using web server or WAF rules to reduce the pool of accounts that can trigger stored payloads.
Enforce a strict Content Security Policy (CSP) on wp-admin responses to limit execution of inline scripts.
Require multi-factor authentication for all WordPress accounts with manage_options or equivalent capabilities.

bash

# Configuration example: locate and remove the vulnerable plugin
wp plugin list --format=csv | grep ws-force-login-page
wp plugin deactivate ws-force-login-page
wp plugin uninstall ws-force-login-page

# Force logout of all users and invalidate sessions
wp user session destroy --all