CVE-2025-49035 Overview
CVE-2025-49035 is a stored Cross-Site Scripting (XSS) vulnerability in the chaimchaikin Admin Menu Groups WordPress plugin. The plugin fails to properly neutralize input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. The stored script executes in the browser of any administrator or user who loads the affected admin page. The issue affects all versions of Admin Menu Groups up to and including 0.1.2. This weakness is classified under CWE-79.
Critical Impact
An authenticated attacker can store JavaScript that executes in other users' browser sessions, enabling session compromise, forced administrative actions, and account takeover chains within the WordPress admin interface.
Affected Products
- WordPress plugin Admin Menu Groups by chaimchaikin
- All versions from initial release through 0.1.2
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-08-27 - CVE-2025-49035 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49035
Vulnerability Analysis
The vulnerability resides in how the Admin Menu Groups plugin processes and renders user-supplied input in the WordPress administrative interface. The plugin accepts data used to define menu group labels or configuration values and writes that data back into rendered HTML without adequate output encoding or sanitization. This falls under CWE-79: Improper Neutralization of Input During Web Page Generation.
Because the payload is persisted in the database, every subsequent load of the affected admin page triggers execution. The scope change indicates that script execution can affect security-relevant elements outside the vulnerable component's own security context, such as other admin sessions. Exploitation requires an authenticated account with high privileges and user interaction from a victim who visits the affected page.
Root Cause
The root cause is missing or insufficient output escaping when the plugin renders stored configuration data into admin pages. Standard WordPress escaping functions such as esc_html(), esc_attr(), and wp_kses() are not applied consistently to the affected fields, allowing HTML and JavaScript to be rendered verbatim.
Attack Vector
An attacker with a privileged WordPress account submits a crafted payload containing JavaScript through the plugin's menu group configuration interface. The payload is stored in the database. When another administrator or user views the resulting menu group in wp-admin, the browser parses the injected script and executes it under the origin of the WordPress site. The attacker can then hijack sessions, exfiltrate nonces, create new administrator accounts, or plant backdoors through the REST API.
No verified proof-of-concept code has been published for CVE-2025-49035. See the Patchstack Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2025-49035
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in plugin option rows within the wp_options or plugin-specific database tables.
- Creation of new administrator accounts or unexpected changes to user roles shortly after an admin visits the Admin Menu Groups configuration page.
- Outbound HTTP requests from admin browser sessions to unfamiliar domains immediately after loading wp-admin pages that render menu groups.
Detection Strategies
- Audit plugin configuration values for HTML entities, script tags, or encoded JavaScript payloads using database queries against plugin-owned rows.
- Monitor WordPress audit logs for administrator activity that writes to Admin Menu Groups settings, especially from newly created or infrequently used accounts.
- Inspect Content Security Policy (CSP) violation reports for inline script execution originating from wp-admin URLs.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record settings changes and admin logins, and forward those logs to a central SIEM.
- Alert on any modification to the Admin Menu Groups plugin options table where the new value contains <script, onerror=, or onload= substrings.
- Review web server access logs for admin-ajax.php and plugin-specific endpoints called by non-administrative source IP addresses.
How to Mitigate CVE-2025-49035
Immediate Actions Required
- Deactivate and remove the Admin Menu Groups plugin on any WordPress site running version 0.1.2 or earlier until a patched release is verified.
- Rotate WordPress administrator passwords and invalidate active sessions using wp auth revoke or an equivalent user management action.
- Review the plugin's stored options and remove any entries containing script or event-handler payloads.
Patch Information
At the time of the last NVD update on 2026-06-17, no fixed version beyond 0.1.2 is listed for the Admin Menu Groups plugin. Consult the Patchstack advisory for the current patch status and any vendor-issued update.
Workarounds
- Restrict access to the WordPress admin interface by IP allowlisting at the web server or WAF layer.
- Apply a virtual patch through a Web Application Firewall to block requests containing script tags or event handlers targeted at the plugin's settings endpoints.
- Enforce the principle of least privilege so that only vetted accounts hold the roles required to modify plugin settings.
- Deploy a strict Content Security Policy in wp-admin that disallows inline scripts, mitigating execution of injected payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
