CVE-2025-47605 Overview
CVE-2025-47605 is a stored Cross-Site Scripting (XSS) vulnerability in the AppJetty WP jQuery DataTable plugin for WordPress. The flaw affects all plugin versions up to and including 4.1.0. It results from improper neutralization of user input during web page generation [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. Successful exploitation can lead to session compromise, administrative action forgery, and cross-scope impact within the WordPress environment.
Critical Impact
A high-privileged attacker can store malicious scripts that execute in victim browsers, enabling session theft and unauthorized actions within the WordPress site.
Affected Products
- AppJetty WP jQuery DataTable plugin for WordPress
- All versions from initial release through 4.1.0
- WordPress sites using wp-jquery-datatable for interactive data tables
Discovery Timeline
- 2025-05-07 - CVE-2025-47605 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47605
Vulnerability Analysis
The WP jQuery DataTable plugin fails to properly sanitize and encode input before rendering it in generated web pages. When an authenticated user submits crafted content through plugin-controlled fields, the payload is stored in the WordPress database and later served to visitors without adequate output encoding. Browsers interpret the injected markup as executable script within the origin of the WordPress site.
Because the payload persists server-side, every user who loads the affected view triggers execution. The scope change indicated in the CVSS vector reflects that injected script executes with the privileges of the viewing user, which may include administrators. That enables lateral impact beyond the vulnerable component itself.
Root Cause
The root cause is missing or inadequate input neutralization in the plugin's data handling paths. Input values are stored verbatim and rendered into HTML contexts without context-appropriate escaping. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for this purpose, but the plugin does not apply them consistently before output.
Attack Vector
Exploitation requires an attacker with high-privilege authenticated access and user interaction from a victim. The attacker submits a crafted payload through a plugin-managed input field. When another user, including an administrator, loads a page that renders the stored value, the script executes in the victim's session context. The attacker can exfiltrate cookies, issue authenticated requests on behalf of the victim, or pivot into other WordPress administrative functions.
Refer to the Patchstack WordPress Vulnerability Advisory for advisory details. No verified public proof-of-concept code is available at this time.
Detection Methods for CVE-2025-47605
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= fragments stored in WordPress database tables associated with the plugin
- Outbound HTTP requests from administrator browsers to unknown domains shortly after loading DataTable views
- New or modified administrator accounts created following visits to plugin-rendered pages
- Anomalous WordPress REST API or admin-ajax.php requests originating from valid administrative sessions
Detection Strategies
- Inspect wp_options and plugin-specific tables for HTML tags or JavaScript event handlers in fields expected to contain plain text
- Deploy a web application firewall rule set that flags script-like payloads submitted to wp-jquery-datatable endpoints
- Review WordPress access logs for POST requests to plugin URLs followed by GET requests loading tainted content
Monitoring Recommendations
- Alert on Content Security Policy (CSP) violation reports referencing inline scripts on plugin pages
- Monitor administrative session activity for actions inconsistent with the user's typical workflow
- Correlate authentication events with plugin configuration changes in a centralized logging pipeline
How to Mitigate CVE-2025-47605
Immediate Actions Required
- Restrict access to WordPress high-privilege roles until a patched plugin version is confirmed installed
- Audit existing plugin data for injected scripts and remove any suspicious stored content
- Enforce multi-factor authentication for all WordPress administrator and editor accounts to limit exploitation prerequisites
- Deploy a Content Security Policy that blocks inline scripts and untrusted script sources
Patch Information
A fixed version beyond 4.1.0 must be applied when available from AppJetty. Consult the Patchstack WordPress Vulnerability Advisory for the current patched release and upgrade instructions. Verify the plugin version through the WordPress admin plugins screen after updating.
Workarounds
- Disable the WP jQuery DataTable plugin on sites where an updated version is not yet available
- Apply a virtual patch through a WordPress-aware web application firewall to strip script tags from plugin input
- Limit which user roles can access the plugin's administrative screens using role management controls
- Rotate WordPress session keys and administrator passwords if compromise is suspected
# Example: identify installed plugin version and disable via WP-CLI
wp plugin get wp-jquery-datatable --field=version
wp plugin deactivate wp-jquery-datatable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
