CVE-2025-48360: Varnish/Nginx Proxy Caching XSS Vulnerability

CVE-2025-48360 Overview

CVE-2025-48360 is a stored cross-site scripting (XSS) vulnerability in the Razvan Stanga Varnish/Nginx Proxy Caching (vcaching) WordPress plugin. The flaw affects all versions up to and including 1.8.3. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected pages. The vulnerability is tracked as [CWE-79] and stems from improper neutralization of user-supplied input during web page generation. Successful exploitation can lead to session theft, administrative account takeover, or further compromise of the WordPress site.

Critical Impact
An authenticated attacker can store malicious scripts that execute in administrator browsers, enabling session hijacking and privileged actions within the WordPress admin interface.

Affected Products

Razvan Stanga Varnish/Nginx Proxy Caching (vcaching) plugin for WordPress
All versions from initial release through 1.8.3
WordPress sites using Varnish or Nginx reverse-proxy cache management via this plugin

Discovery Timeline

2025-08-28 - CVE-2025-48360 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48360

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. The vcaching plugin accepts user-supplied input through one or more administrative input fields and renders that input back into HTML without adequate output encoding or input sanitization. Because the payload is persisted in the WordPress database, the injected script executes every time a user loads the affected admin page. Exploitation requires an authenticated session with high privileges and user interaction from a victim, which limits mass exploitation but still enables targeted privilege escalation within multi-user WordPress deployments.

Root Cause

The root cause is missing or insufficient sanitization of input values before they are stored and later echoed into the rendered HTML of plugin administration pages. The plugin does not consistently apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to user-controlled data. As a result, HTML and JavaScript characters pass through unchanged and are interpreted by the browser when the page is rendered.

Attack Vector

An attacker with authenticated access to the plugin configuration injects a malicious payload into a vulnerable input field. The payload is written to the WordPress database. When another authenticated user, typically an administrator, loads the plugin page, the stored payload executes in the context of that user's session. The attacker can then exfiltrate session cookies, perform CSRF-like actions using the victim's credentials, modify cache rules to serve attacker-controlled content, or pivot to full site compromise.

See the Patchstack Vulnerability Report - XSS for additional technical context.

Detection Methods for CVE-2025-48360

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handlers (onerror, onload) stored in vcaching plugin option rows within the wp_options table
Administrator sessions originating from unexpected IP addresses shortly after a visit to the plugin's settings page
Creation of new administrator accounts or modification of user roles following plugin page access
Outbound requests from administrator browsers to unfamiliar domains referenced in the HTTP Referer header of the plugin admin URL

Detection Strategies

Audit the WordPress database for stored plugin configuration values containing HTML or script syntax
Review web server access logs for POST requests to vcaching administrative endpoints followed by unusual GET activity from privileged users
Enable a Web Application Firewall (WAF) rule set that flags reflected and stored XSS patterns targeting WordPress plugin endpoints
Deploy Content Security Policy (CSP) reporting to surface unexpected script execution within the /wp-admin/ scope

Monitoring Recommendations

Monitor WordPress audit logs for configuration changes to the vcaching plugin, especially from accounts that do not normally manage caching
Track administrator login activity for session anomalies that correlate with plugin page visits
Alert on new administrator accounts, modified user capabilities, or newly installed plugins following suspicious activity on the cache management interface

How to Mitigate CVE-2025-48360

Immediate Actions Required

Upgrade the Varnish/Nginx Proxy Caching (vcaching) plugin to a version later than 1.8.3 as soon as a patched release is available
Audit all WordPress administrator and editor accounts and remove any that are inactive or unnecessary
Rotate credentials and invalidate active sessions for any user who accessed the plugin configuration during the exposure window
Inspect the wp_options table and plugin configuration for stored HTML or JavaScript payloads and remove them

Patch Information

At the time of publication the vendor advisory confirms the vulnerability affects versions through 1.8.3. Administrators should consult the Patchstack Vulnerability Report - XSS for the current fixed-version status and apply the vendor-supplied update as soon as it is released.

Workarounds

Deactivate the vcaching plugin until a patched version is installed if cache management is not business-critical
Restrict access to the plugin's administrative pages using an IP allowlist at the web server or WAF layer
Enforce a strict Content Security Policy on /wp-admin/ to block inline script execution and limit third-party script sources
Limit administrative privileges to the smallest necessary group of trusted users

bash

# Example Nginx snippet restricting access to the plugin admin page by source IP
location ~* /wp-admin/admin\.php {
    if ($arg_page = "vcaching") {
        allow 203.0.113.0/24;   # trusted admin network
        deny all;
    }
}