CVE-2025-48315 Overview
CVE-2025-48315 is a stored cross-site scripting (XSS) vulnerability in the stanton119 WordPress HTML plugin (custom-html-bodyhead). The flaw affects all versions up to and including 0.51. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with low privileges to inject persistent script payloads. When another user loads an affected page, the malicious script executes in the victim's browser under the site's origin. This vulnerability is tracked under CWE-79.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in visitors' and administrators' browsers, enabling session hijacking, credential theft, and unauthorized administrative actions.
Affected Products
- WordPress HTML plugin (custom-html-bodyhead) versions up to and including 0.51
- WordPress installations using the stanton119 HTML plugin
- Any site permitting low-privileged authors or contributors to interact with plugin input fields
Discovery Timeline
- 2025-08-28 - CVE-2025-48315 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48315
Vulnerability Analysis
The WordPress HTML plugin allows administrators and other privileged users to insert custom HTML into the <body> and <head> sections of rendered pages. The plugin does not sanitize or encode input before writing it into the generated page markup. An attacker with authenticated access supplies HTML containing a <script> element or an event-handler attribute. The plugin persists the payload in the WordPress database and emits it verbatim on subsequent page loads.
Because the injected script runs in the context of the WordPress site origin, it can access the DOM, session cookies not marked HttpOnly, and any application state visible to the victim. Stored XSS in a WordPress plugin is particularly impactful because payloads execute for every visitor rendering the affected content, including administrators viewing the site while logged in.
Root Cause
The root cause is missing output encoding and input validation during web page generation. The plugin trusts input from authenticated users and inserts it directly into HTML output without applying WordPress sanitization primitives such as wp_kses() or context-appropriate escaping functions like esc_html() and esc_attr().
Attack Vector
Exploitation requires network access, low privileges, and user interaction. An authenticated attacker submits crafted HTML through the plugin's configuration interface. The payload persists across sessions and executes when other users visit the affected pages. The scope change component reflects that script execution reaches users beyond the attacker's own security context. See the Patchstack advisory for technical details.
Detection Methods for CVE-2025-48315
Indicators of Compromise
- Presence of <script> tags, onerror=, onload=, or javascript: URIs in HTML fields configured through the custom-html-bodyhead plugin
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from WordPress pages
- Anomalous wp-admin activity such as new administrator accounts or plugin installations following visits to affected pages
Detection Strategies
- Audit the plugin's stored configuration in the wp_options table for HTML values containing script content or event-handler attributes
- Inspect page source of published content for injected script tags not authored by administrators
- Correlate WordPress access logs with authenticated user sessions that modified plugin settings prior to XSS artifact appearance
Monitoring Recommendations
- Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on WordPress properties
- Monitor plugin option changes through WordPress audit logging tools and forward events to a centralized SIEM
- Alert on creation of new privileged WordPress accounts or unauthorized plugin activations following the disclosure date
How to Mitigate CVE-2025-48315
Immediate Actions Required
- Disable the custom-html-bodyhead plugin until a patched release is confirmed available from the maintainer
- Restrict WordPress author, editor, and contributor accounts to trusted personnel and enforce multi-factor authentication
- Review all HTML content currently stored by the plugin and remove any script tags, event handlers, or external resource references
Patch Information
No fixed version has been published at the time of NVD entry publication. Consult the Patchstack Vulnerability Report for the current remediation status and update the plugin immediately when a patched version becomes available.
Workarounds
- Remove or deactivate the plugin and replace its functionality with a maintained alternative that sanitizes HTML input
- Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
- Place the WordPress admin interface behind a web application firewall rule that filters HTML payloads containing script tags in plugin configuration endpoints
# Example CSP header restricting inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.