CVE-2025-49413: Super Store Finder XSS Vulnerability

CVE-2025-49413 Overview

CVE-2025-49413 is a reflected cross-site scripting (XSS) vulnerability in the highwarden Super Store Finder plugin (superstorefinder-wp) for WordPress. The flaw affects all versions through 7.6 and stems from improper neutralization of user input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by an authenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability requires user interaction but no authentication, and operates with a scope change that allows the injected script to affect resources beyond the vulnerable component.

Critical Impact
Attackers can hijack administrator sessions, steal credentials, or perform unauthorized actions on behalf of victims by delivering crafted links to WordPress users.

Affected Products

highwarden Super Store Finder (superstorefinder-wp) WordPress plugin
All versions from initial release through 7.6
WordPress sites with the plugin installed and active

Discovery Timeline

2025-08-20 - CVE-2025-49413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49413

Vulnerability Analysis

The Super Store Finder plugin fails to sanitize user-supplied input before reflecting it into HTTP responses. When a request parameter is echoed back into the rendered page without proper encoding, an attacker can inject HTML or JavaScript that the browser executes in the context of the vulnerable site. Because the vulnerability has a changed scope, the injected payload can impact resources outside the plugin boundary, such as the WordPress administration interface or user session cookies.

Root Cause

The root cause is missing output encoding and input validation on parameters consumed by the plugin's request handlers. Values passed through URL parameters flow directly into HTML output without passing through WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses(). This allows attacker-controlled markup to break out of its intended context and execute as script content.

Attack Vector

Exploitation requires an attacker to craft a URL containing a malicious payload targeting a vulnerable endpoint in the plugin. The attacker then delivers that URL to a victim through phishing, chat, or an attacker-controlled website. When the victim clicks the link while visiting the vulnerable WordPress site, the embedded script executes with the victim's privileges. See the Patchstack Vulnerability Analysis for additional technical context on the vulnerable parameter.

Detection Methods for CVE-2025-49413

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or onload= patterns in query parameters targeting Super Store Finder endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains following link clicks
WordPress administrator session cookies appearing in referer headers or third-party logs
Unauthorized plugin, theme, or user account changes in WordPress logs without corresponding legitimate admin activity

Detection Strategies

Deploy a web application firewall (WAF) with rules that identify reflected XSS payloads in query strings for superstorefinder-wp URL paths
Review web server access logs for URL-encoded script fragments such as %3Cscript%3E or %22onerror%3D targeting plugin endpoints
Monitor WordPress audit logs for configuration changes, new administrator accounts, or plugin modifications after suspicious URL requests

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward access logs to a centralized SIEM for parameter inspection
Alert on repeated requests to Super Store Finder endpoints containing special characters commonly used in XSS payloads
Track browser-side errors and Content Security Policy (CSP) violation reports that may indicate injected script activity

How to Mitigate CVE-2025-49413

Immediate Actions Required

Identify all WordPress sites running Super Store Finder version 7.6 or earlier and prioritize them for patching
Deactivate the plugin on sites where a patched version is not yet available and the feature is not business-critical
Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins
Instruct WordPress administrators to avoid clicking untrusted links while authenticated to the admin console

Patch Information

At the time of publication, the NVD entry lists affected versions through 7.6. Site owners should consult the Patchstack Vulnerability Analysis and the WordPress plugin repository for the current fixed version and apply the update as soon as it is available.

Workarounds

Deploy WAF rules to block requests containing script tags, event handlers, or javascript: schemes in parameters sent to Super Store Finder
Restrict access to WordPress administration pages by IP allowlist where feasible
Require administrators to use isolated browser profiles that do not retain third-party browsing history

bash

# Example ModSecurity rule to block reflected XSS payloads targeting the plugin
SecRule REQUEST_URI "@contains superstorefinder" \
    "chain,id:1004913,phase:2,deny,status:403,msg:'Potential XSS targeting Super Store Finder'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:lowercase"