CVE-2025-47618 Overview
CVE-2025-47618 is a reflected Cross-Site Scripting (XSS) vulnerability in the BMI Adult & Kid Calculator WordPress plugin developed by Mortgage Calculator. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Affected versions include all releases up to and including 1.2.2. Attackers can craft malicious links that, when clicked by an authenticated or unauthenticated victim, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction and operates over the network with no privileges required.
Critical Impact
Successful exploitation enables session hijacking, credential theft, and arbitrary actions performed in the context of the victim's WordPress session.
Affected Products
- Mortgage Calculator BMI Adult & Kid Calculator plugin (bmi-adultkid-calculator)
- All versions from initial release through 1.2.2
- WordPress sites with the vulnerable plugin installed and active
Discovery Timeline
- 2025-05-23 - CVE-2025-47618 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-47618
Vulnerability Analysis
The bmi-adultkid-calculator plugin fails to sanitize or encode user input before reflecting it back into the generated HTML response. This permits attackers to inject arbitrary JavaScript through manipulated request parameters. When a victim follows a crafted URL, the injected payload executes in their browser within the security context of the WordPress site. The vulnerability changes the scope of impact beyond the vulnerable component because executed scripts can access cookies, the DOM, and APIs of the hosting WordPress site. Confidentiality, integrity, and availability impacts are all rated low individually, but the cross-scope execution amplifies real-world risk against site administrators and authenticated users.
Root Cause
The root cause is missing output encoding and input validation on request parameters processed by the plugin. User-controlled data flows directly into the HTML response without being passed through WordPress sanitization helpers such as esc_html(), esc_attr(), or wp_kses(). This violates secure coding practices for input handling on web page generation [CWE-79].
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts or distributes a malicious URL containing an XSS payload targeting a vulnerable plugin endpoint. The victim must click the link while browsing a site running the affected plugin. The reflected payload then executes in the victim's browser. Common attacker objectives include stealing authentication cookies, performing actions as the victim through WordPress administrative endpoints, redirecting users to attacker-controlled domains, or delivering follow-on malware. Detailed payload research is documented in the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2025-47618
Indicators of Compromise
- HTTP request logs containing reflected parameters with <script>, javascript:, onerror=, or onload= payloads targeting the plugin's endpoints
- Unexpected outbound requests from administrator browsers to unfamiliar domains following a click on a crafted link
- New or modified WordPress administrator accounts created shortly after suspicious admin sessions
Detection Strategies
- Inspect web server access logs for query strings containing URL-encoded HTML or script tags directed at bmi-adultkid-calculator pages
- Deploy a web application firewall (WAF) rule set that flags reflected XSS patterns in GET and POST parameters
- Correlate referrer headers from external sources with subsequent administrative actions inside WordPress
Monitoring Recommendations
- Monitor WordPress audit logs for privilege changes, plugin installations, and option modifications following user click events
- Alert on Content Security Policy (CSP) violation reports indicating inline script execution attempts
- Track plugin version inventory across managed WordPress sites to identify hosts still running 1.2.2 or earlier
How to Mitigate CVE-2025-47618
Immediate Actions Required
- Update the BMI Adult & Kid Calculator plugin to a version later than 1.2.2 once the vendor publishes a fix
- Deactivate and remove the plugin from any WordPress instance where an updated release is unavailable
- Force re-authentication for all administrative users and rotate session cookies on affected sites
Patch Information
At the time of NVD publication, the vulnerability affects all versions through 1.2.2. Site administrators should consult the Patchstack WordPress Vulnerability Report for current patch availability and upgrade guidance.
Workarounds
- Deploy a WAF with rules that block reflected XSS payloads targeting the plugin's parameters
- Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted domains
- Restrict access to the WordPress administrative interface using IP allowlisting or VPN gating to reduce exposure of privileged sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
