CVE-2025-47665: N360 Splash Screen Stored XSS Vulnerability

CVE-2025-47665 Overview

CVE-2025-47665 is a stored cross-site scripting (XSS) vulnerability in the bistromatic N360 Splash Screen WordPress plugin (n360-splash-screen). The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all plugin versions up to and including 1.0.6. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browser of any user who loads an affected page. Successful exploitation requires user interaction and can result in scope change, allowing attacks against components beyond the vulnerable plugin.

Critical Impact
Stored JavaScript payloads execute in the context of site visitors and administrators, enabling session theft, account takeover, and further compromise of the WordPress environment.

Affected Products

bistromatic N360 Splash Screen WordPress plugin (n360-splash-screen)
All versions from initial release through 1.0.6
WordPress sites with the plugin installed and active

Discovery Timeline

2025-05-07 - CVE-2025-47665 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47665

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) issue in the N360 Splash Screen plugin. The plugin fails to properly sanitize or encode user-supplied input before rendering it into HTML output generated by WordPress. Because the payload is stored server-side, it executes each time a user loads the affected page. The issue is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation.

Exploitation requires an authenticated actor with high privileges to submit the payload, and the victim must load a page rendering the tainted content. The scope change indicates that injected script can affect resources beyond the vulnerable component, such as browser session data belonging to administrative users.

Root Cause

The root cause is missing output encoding and input sanitization in plugin code paths that render administrator-supplied data. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() to neutralize HTML control characters, but the plugin does not consistently apply them before echoing values into the rendered page.

Attack Vector

An attacker with a privileged plugin configuration role stores an HTML or JavaScript payload in a plugin setting. When another user visits a page that includes the splash screen output, the browser parses the payload as executable script. The attacker can hijack sessions, perform forced administrative actions, or pivot to install malicious plugins. See the Patchstack advisory for additional context.

Detection Methods for CVE-2025-47665

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings inside N360 Splash Screen plugin options in the wp_options table
Outbound browser requests from administrator sessions to unfamiliar domains after visiting splash-screen pages
Newly created WordPress administrator accounts or modified user roles without corresponding admin activity

Detection Strategies

Inspect stored plugin configuration values in the WordPress database for HTML tags or event handler attributes
Deploy a web application firewall (WAF) rule set that flags XSS payload patterns targeting admin.php and plugin settings endpoints
Review WordPress audit logs for setting changes made by high-privilege accounts on the n360-splash-screen plugin

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions
Alert on file integrity changes in the wp-content/plugins/n360-splash-screen/ directory
Correlate authenticated admin session anomalies with page loads that render splash-screen content

How to Mitigate CVE-2025-47665

Immediate Actions Required

Deactivate the N360 Splash Screen plugin until a patched version is confirmed installed
Audit all plugin settings for stored HTML or JavaScript and remove untrusted content
Rotate WordPress administrator credentials and invalidate active sessions
Review recent administrative activity for unauthorized user or role changes

Patch Information

At the time of publication, the vendor advisory referenced by Patchstack lists all versions through 1.0.6 as affected. Administrators should monitor the plugin listing on WordPress.org for a fixed release and update immediately when available.

Workarounds

Restrict access to plugin configuration screens to a minimal set of trusted administrators
Enforce a strict Content Security Policy that disallows inline scripts and unknown external origins
Deploy a WAF rule to block requests containing script tags or event handler attributes submitted to plugin settings endpoints
Uninstall the plugin if the splash-screen functionality is not required

bash

# Configuration example: disable the plugin via WP-CLI until a patch is available
wp plugin deactivate n360-splash-screen
wp plugin status n360-splash-screen