CVE-2025-49067 Overview
CVE-2025-49067 is a stored cross-site scripting (XSS) vulnerability in the NasaTheme Nasa Core WordPress plugin. The flaw affects all versions up to and including 6.4.1 and results from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with low privileges can inject malicious JavaScript that persists in the application and executes in the browsers of users who view affected pages. Because the payload crosses trust boundaries between the plugin and rendered pages, exploitation can compromise session data, deliver malware, or redirect users to attacker-controlled sites.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in victims' browsers, enabling session theft, content manipulation, and phishing against site visitors and administrators.
Affected Products
- NasaTheme Nasa Core plugin for WordPress
- All versions from initial release through 6.4.1
- WordPress sites using the Nasa Core plugin as an eCommerce theme dependency
Discovery Timeline
- 2025-06-06 - CVE-2025-49067 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49067
Vulnerability Analysis
The vulnerability is a stored XSS flaw classified under [CWE-79]. Nasa Core accepts input from an authenticated user and writes it to persistent storage without sufficient output encoding or input sanitization. When another user loads a page containing the stored data, the browser renders the attacker's payload as executable script in the site's origin.
Exploitation requires user interaction, meaning a victim must visit a page containing the injected content. Because the vulnerability changes scope, script executes with access to resources belonging to the WordPress origin, including cookies scoped to the site. The attacker requires only low-privilege authentication, which is common in WordPress environments that permit contributor or subscriber registration.
An EPSS score of 0.19% indicates a low probability of exploitation in the immediate term, but stored XSS in widely deployed WordPress plugins is a recurring vector for credential theft and administrative account takeover.
Root Cause
The root cause is missing or insufficient input neutralization in one or more Nasa Core input handlers. User-controlled fields are stored in the WordPress database and later reflected into HTML output without contextual escaping, allowing HTML and JavaScript syntax to be interpreted by the browser rather than rendered as literal text.
Attack Vector
The attack vector is network-based through the WordPress web interface. An authenticated attacker submits crafted input containing HTML or JavaScript through a plugin form or setting. Nasa Core stores the payload, and any subsequent visitor rendering the affected page executes the script under the site origin. See the Patchstack XSS Vulnerability Advisory for advisory details.
Detection Methods for CVE-2025-49067
Indicators of Compromise
- Unexpected <script> tags, on* event handlers, or javascript: URIs stored in WordPress post, option, or plugin-specific tables associated with Nasa Core
- Outbound requests from administrator sessions to unfamiliar domains shortly after loading pages rendered by Nasa Core
- New administrative users or modified user roles created shortly after Nasa Core pages were accessed by privileged accounts
Detection Strategies
- Audit database entries written by Nasa Core for HTML control characters and script-related keywords such as onerror, onload, and <svg
- Review WordPress access logs for POST requests to Nasa Core endpoints originating from low-privilege accounts
- Inspect rendered pages using automated scanners that flag reflected or stored script content in plugin-controlled output
Monitoring Recommendations
- Enable WordPress activity logging to record content changes made by contributors, subscribers, and other low-privilege roles
- Monitor administrator browser sessions for anomalous JavaScript execution and unexpected fetch requests to external hosts
- Track plugin version inventory across WordPress deployments and alert when Nasa Core installations remain on versions at or below 6.4.1
How to Mitigate CVE-2025-49067
Immediate Actions Required
- Update Nasa Core to a version later than 6.4.1 once the vendor publishes a fixed release
- Restrict registration and revoke unnecessary low-privilege accounts that can submit content through Nasa Core forms
- Rotate credentials and session tokens for administrative users who may have viewed pages containing untrusted content
Patch Information
Refer to the Patchstack XSS Vulnerability Advisory for the current patch status and upgrade guidance from NasaTheme.
Workarounds
- Deploy a web application firewall rule that blocks HTML and JavaScript syntax in Nasa Core request parameters
- Apply a strict Content-Security-Policy header that disallows inline scripts and restricts script sources to trusted origins
- Temporarily disable Nasa Core on affected sites if an upgrade path is not immediately available and the plugin is not business-critical
# Example Content-Security-Policy header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
