CVE-2025-47676 Overview
CVE-2025-47676 is a stored Cross-Site Scripting (XSS) vulnerability in the Faiyaz Alam User Login History plugin for WordPress. The flaw affects all versions up to and including 2.1.6. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. Successful exploitation can lead to session hijacking, credential theft, and unauthorized administrative actions when a privileged user renders the poisoned content.
Critical Impact
Authenticated attackers can store malicious scripts that execute in administrator sessions, enabling account takeover and lateral compromise of WordPress deployments.
Affected Products
- Faiyaz Alam User Login History plugin for WordPress
- All versions from initial release through 2.1.6
- WordPress sites where the plugin is installed and active
Discovery Timeline
- 2025-05-07 - CVE CVE-2025-47676 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47676
Vulnerability Analysis
The User Login History plugin records authentication events and displays them within the WordPress administrative interface. The plugin fails to properly sanitize or encode input fields before rendering them in generated HTML output. An attacker who can influence logged fields, such as user-agent strings or other request-derived metadata, can inject script payloads. Those payloads persist in the plugin's data store and execute when an administrator or another user views the login history page.
Because the attack scope changes to affect other users' security contexts, the vulnerability crosses a trust boundary from a low-privileged account to any user with access to the logging interface.
Root Cause
The root cause is missing output encoding and inadequate input validation on data written to and read from the plugin's history records. The plugin trusts stored values when constructing HTML responses, allowing arbitrary markup and JavaScript to be reflected into administrative views.
Attack Vector
Exploitation requires network access and user interaction from a victim who views the affected admin page. An attacker with an authenticated low-privilege account, or in some configurations an unauthenticated actor who can trigger logged events, submits crafted input containing HTML or JavaScript. The payload is persisted by the plugin and executes when a higher-privileged user loads the login history view. See the Patchstack WordPress XSS Vulnerability advisory for additional technical context.
Detection Methods for CVE-2025-47676
Indicators of Compromise
- Unexpected <script>, onerror, or onload attributes in stored user-agent or metadata fields within the plugin's database tables.
- Administrative sessions initiating outbound requests to unfamiliar domains shortly after opening the login history page.
- Creation of new WordPress administrator accounts or unexpected changes to user roles following admin access to the logging interface.
Detection Strategies
- Query the plugin's history tables for HTML entities, angle brackets, or JavaScript event handlers embedded in text fields.
- Inspect web server access logs for requests containing encoded script payloads targeting authentication endpoints monitored by the plugin.
- Review WordPress audit logs for privilege changes or plugin activity correlated with admin visits to login history pages.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface inline script violations originating from the WordPress admin dashboard.
- Monitor for anomalous administrator behavior, including new API tokens, plugin installations, or theme file edits.
- Alert on outbound traffic from admin browsers to previously unseen domains during authenticated sessions.
How to Mitigate CVE-2025-47676
Immediate Actions Required
- Update the User Login History plugin to a version later than 2.1.6 as soon as a fixed release is available from the vendor.
- Audit the plugin's stored records for injected markup and purge any suspicious entries.
- Rotate credentials and session tokens for administrator accounts that accessed the login history page during the exposure window.
Patch Information
Refer to the Patchstack WordPress XSS Vulnerability advisory for the latest patch status. If no vendor patch is available, consider deactivating and removing the plugin until a fix is published.
Workarounds
- Deactivate the User Login History plugin on affected WordPress instances until a patched release is verified.
- Restrict access to the WordPress admin dashboard using network-level controls such as IP allowlists or VPN gating.
- Deploy a web application firewall (WAF) rule that blocks script tags and JavaScript event handlers in fields consumed by the plugin.
# Configuration example
wp plugin deactivate user-login-history
wp plugin delete user-login-history
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
