CVE-2025-47442 Overview
CVE-2025-47442 is a stored cross-site scripting (XSS) vulnerability in the CC BMI Calculator WordPress plugin (cc-bmi-calculator). The flaw affects all versions up to and including 2.1.0. It results from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79]. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. Because the attack crosses trust boundaries, exploitation can affect site visitors and administrators alike.
Critical Impact
An authenticated attacker with low privileges can store malicious JavaScript in the plugin, enabling session theft, administrative account takeover, and delivery of malware to site visitors.
Affected Products
- CC BMI Calculator WordPress plugin (cc-bmi-calculator)
- All versions from initial release through 2.1.0
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-05-07 - CVE-2025-47442 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47442
Vulnerability Analysis
The vulnerability is a stored cross-site scripting flaw in the CC BMI Calculator plugin for WordPress. The plugin accepts input that is later rendered in web pages without adequate sanitization or output encoding. Attacker-supplied script content is persisted server-side and executed each time a victim renders the affected view.
The attack requires network access, low-privilege authentication, and user interaction. The scope is changed, meaning injected script executes in a security context different from the vulnerable component. Confidentiality, integrity, and availability impacts are all limited but non-zero.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin fails to apply WordPress sanitization functions such as sanitize_text_field() on input or escaping helpers such as esc_html(), esc_attr(), and wp_kses_post() on output. As a result, HTML and JavaScript submitted through plugin inputs are stored verbatim and later reflected into the DOM.
Attack Vector
An authenticated user with low-level access submits crafted content containing HTML script tags or event-handler attributes through a plugin input field. The payload is stored in the WordPress database. When another user, including an administrator, loads a page that renders the stored content, the browser executes the attacker's script under the site's origin.
Typical post-exploitation actions include stealing session cookies, performing forced administrative actions through the WordPress REST API, redirecting visitors to attacker-controlled infrastructure, and delivering browser-based malware. See the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-47442
Indicators of Compromise
- Unexpected <script> tags, onerror, onload, or javascript: URIs stored in wp_postmeta, wp_options, or plugin-specific tables associated with cc-bmi-calculator.
- Outbound browser requests from site visitors to unfamiliar domains after loading pages that embed the BMI calculator shortcode.
- Creation of new WordPress administrator accounts or unexpected role changes shortly after low-privileged user activity.
- Web server access logs showing POST requests to plugin endpoints containing URL-encoded HTML or script payloads.
Detection Strategies
- Scan the WordPress database for plugin-owned rows containing script tags, event handlers, or encoded JavaScript patterns.
- Deploy a web application firewall rule that inspects requests to plugin endpoints for XSS signatures and blocks payloads with HTML markup where not expected.
- Correlate authenticated low-privilege sessions with subsequent administrator activity from the same IP or user agent.
Monitoring Recommendations
- Enable WordPress audit logging to record content changes made through the plugin and by low-privileged accounts.
- Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render BMI calculator output.
- Alert on the appearance of new administrator accounts, plugin installations, or theme file modifications following suspicious input.
How to Mitigate CVE-2025-47442
Immediate Actions Required
- Deactivate the CC BMI Calculator plugin on all WordPress sites until a patched version is confirmed installed.
- Audit the WordPress database for stored payloads and remove any injected script content from plugin-controlled fields.
- Rotate credentials and invalidate active sessions for all administrative accounts on affected sites.
- Review recently created users and installed plugins for unauthorized changes.
Patch Information
At the time of publication, the vulnerability affects all versions of cc-bmi-calculator through 2.1.0. Administrators should consult the Patchstack advisory for the latest fix availability and upgrade to a patched release once released by the maintainer.
Workarounds
- Remove or deactivate the plugin if a patched version is not yet available.
- Restrict WordPress user registration and limit which roles can access plugin input fields.
- Deploy a web application firewall with XSS filtering in front of the WordPress site.
- Implement a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources.
# Example: enforce a restrictive CSP header in Apache for the WordPress site
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.