CVE-2025-47592: Terms Popup On User Login Stored XSS

CVE-2025-47592 Overview

CVE-2025-47592 is a stored cross-site scripting (XSS) vulnerability in the Terms Popup On User Login WordPress plugin developed by Árpád Lehel Mátyus. The flaw affects all plugin versions up to and including 2.0.8. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of other users who load affected pages. The vulnerability is tracked under CWE-79 and was published to the National Vulnerability Database on May 7, 2025.

Critical Impact

Stored XSS payloads persist in the WordPress database and execute against site visitors and administrators, enabling session theft, forced actions, and further site compromise.

Affected Products

• Terms Popup On User Login WordPress plugin (terms-popup-on-user-login)
• All versions from initial release through 2.0.8
• WordPress and WooCommerce sites using the plugin for login and checkout terms popups

Discovery Timeline

• 2025-05-07 - CVE-2025-47592 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47592

Vulnerability Analysis

The plugin fails to properly neutralize user-supplied input before writing it into web page output. An authenticated user with administrative privileges can submit malicious HTML or JavaScript through plugin configuration fields. The plugin stores the payload in the WordPress database and later renders it without encoding or sanitization. When another user loads a page containing the injected content, the script executes in that user's browser session.

The attack is scoped as changed, meaning the injected script executes in a security context different from the vulnerable component. This allows the payload to affect visitors and other administrators, not just the account used to inject it. Successful exploitation compromises confidentiality, integrity, and availability of user sessions.

Root Cause

The root cause is missing output encoding and input sanitization in fields exposed by the plugin's administration interface. WordPress provides sanitization helpers such as wp_kses_post(), esc_html(), and esc_attr(), but the vulnerable code paths do not apply them consistently to configurable popup content before rendering.

Attack Vector

Exploitation requires an attacker to hold an administrative or equivalently privileged WordPress account and requires a victim to load a page that renders the injected content. The attacker submits a crafted payload through the plugin settings. The payload persists in the database and fires each time an affected page is rendered, giving the attacker a durable foothold for session hijacking, credential harvesting, and unauthorized configuration changes.

No verified public exploit code is available. Refer to the Patchstack Vulnerability Report for the vendor advisory.

Detection Methods for CVE-2025-47592

Indicators of Compromise

• Unexpected <script>, onerror, onload, or javascript: strings stored inside WordPress options related to the terms-popup-on-user-login plugin.
• Outbound HTTP requests from browser sessions to unfamiliar domains immediately after users interact with the login or checkout popup.
• New or modified administrator accounts created shortly after an administrator loaded a popup-affected page.

Detection Strategies

• Inspect the wp_options table for plugin settings entries containing HTML tags or JavaScript event handlers.
• Review web server access logs for administrative POST requests to plugin settings endpoints followed by anomalous client-side traffic.
• Deploy a web application firewall rule that flags stored HTML fragments in known plugin configuration parameters.

Monitoring Recommendations

• Enable WordPress audit logging for plugin configuration changes and administrator login events.
• Alert on Content Security Policy (CSP) violation reports originating from pages that render the terms popup.
• Correlate administrator session activity with subsequent script executions in end-user browsers.

How to Mitigate CVE-2025-47592

Immediate Actions Required

• Identify all WordPress sites running the Terms Popup On User Login plugin at version 2.0.8 or earlier.
• Deactivate the plugin until a patched release is verified and installed.
• Rotate credentials and invalidate active sessions for all administrator accounts on affected sites.
• Audit the wp_options table and remove any stored HTML or JavaScript payloads in plugin settings.

Patch Information

At the time of the last NVD update on June 17, 2026, no fixed version beyond 2.0.8 is listed in the CVE record. Monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for updates and apply the vendor patch as soon as it becomes available.

Workarounds

• Restrict plugin configuration access to a minimal set of trusted administrators and require multi-factor authentication.
• Enforce a strict Content Security Policy that blocks inline scripts on pages rendering the popup content.
• Deploy a WAF rule that strips HTML tags and JavaScript event handlers from POST parameters targeting the plugin's admin endpoints.
• Replace the plugin with an alternative that properly sanitizes configurable popup content.

# Example CSP header to block inline script execution on WordPress pages
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"