CVE-2025-48236: bunny.net BunnyCDN Stored XSS Vulnerability

CVE-2025-48236 Overview

CVE-2025-48236 is a stored cross-site scripting (XSS) vulnerability in the bunny.net bunnycdn WordPress plugin. The flaw affects all versions up to and including 2.3.0. An authenticated attacker with low privileges can inject malicious script content that persists in the application and executes in the browsers of other users who view the affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. The scope is changed, meaning the injected payload can affect resources beyond the vulnerable component's security boundary.

Critical Impact
A low-privileged authenticated user can store JavaScript payloads that execute in administrator browsers, enabling session theft, privilege escalation, and content manipulation across the WordPress site.

Affected Products

bunny.net bunnycdn WordPress plugin versions up to and including 2.3.0
WordPress installations using the bunny.net CDN integration
Sites granting contributor or higher roles to untrusted users

Discovery Timeline

2025-05-19 - CVE-2025-48236 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-48236

Vulnerability Analysis

The bunny.net plugin fails to properly neutralize user-supplied input before rendering it within generated web pages. An authenticated user submits crafted input containing HTML or JavaScript through a plugin field, and the application stores the payload without adequate sanitization or output encoding. When another user, typically an administrator, loads the affected page, the browser parses and executes the attacker's script in the context of the WordPress site. The changed scope indicator reflects that the executed script can operate beyond the plugin's component boundary, including the broader WordPress admin interface. Successful exploitation can lead to authentication cookie theft, forced administrative actions, and persistent backdoor injection through additional plugin or theme modifications.

Root Cause

The root cause is insufficient input validation and output encoding within the bunny.net plugin code paths that accept administrator or contributor-level input. The plugin does not apply WordPress sanitization functions such as sanitize_text_field() on input, nor does it apply esc_html() or esc_attr() when rendering stored values back into HTML contexts.

Attack Vector

Exploitation requires network access to the WordPress site and a valid authenticated session with at least low-level privileges. The attacker submits an HTML or JavaScript payload through a plugin field that lacks proper sanitization. The payload is persisted in the WordPress database. When a privileged user loads the page containing the stored payload, the browser executes the script under the site origin, allowing the attacker to perform actions on behalf of the victim. User interaction is not required beyond loading the affected page, per the CVSS vector.

No verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-48236

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes such as onerror and onload stored in WordPress wp_options, wp_postmeta, or plugin-specific tables
Outbound requests from administrator browsers to unfamiliar domains shortly after loading bunny.net plugin pages
New administrator accounts or modified user roles following an authenticated session that visited plugin settings
Modified theme or plugin files containing obfuscated JavaScript inserted after plugin page access

Detection Strategies

Inspect plugin-related database tables for HTML or JavaScript content using SQL queries that match patterns such as %<script% or %javascript:%
Review WordPress audit logs for input submissions to bunny.net plugin endpoints by low-privileged users
Compare current plugin version against version 2.3.0 across all managed WordPress sites
Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in administrator sessions

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized logging platform and alert on POST requests to bunny.net plugin admin endpoints
Monitor for plugin file integrity changes on disk and unexpected modifications to wp_options rows tied to the bunnycdn plugin
Track administrator authentication events that follow visits to plugin configuration pages
Alert on creation of new privileged WordPress users or REST API key changes

How to Mitigate CVE-2025-48236

Immediate Actions Required

Update the bunny.net bunnycdn plugin to a version newer than 2.3.0 once a patched release is published by the vendor
Audit all WordPress users with contributor or higher privileges and remove inactive or unnecessary accounts
Review plugin configuration fields and database content for previously stored script payloads
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected

Patch Information

Review the Patchstack Vulnerability Report for the latest patch status. Apply the vendor-supplied fix when available and verify the installed plugin version is greater than 2.3.0.

Workarounds

Deactivate the bunny.net plugin until a patched version is installed
Restrict access to the WordPress admin area using IP allowlisting at the web server or WAF layer
Deploy a web application firewall rule that blocks requests containing common XSS patterns targeting bunny.net plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts in the WordPress admin interface

bash

# Configuration example
# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate bunnycdn

# Verify installed version
wp plugin get bunnycdn --field=version