CVE-2025-49450: SEPA Girocode Stored XSS Vulnerability

CVE-2025-49450 Overview

CVE-2025-49450 is a stored cross-site scripting (XSS) vulnerability in the mhallmann SEPA Girocode WordPress plugin (sepa-girocode). The flaw affects all versions up to and including 0.5.1. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent JavaScript payloads. When other users render the affected pages, the malicious script executes in their browser context. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the browsers of other site users, enabling session theft, unauthorized actions, and content manipulation within the WordPress site.

Affected Products

mhallmann SEPA Girocode WordPress plugin
All versions from initial release through 0.5.1
WordPress installations that have sepa-girocode installed and active

Discovery Timeline

2025-06-06 - CVE-2025-49450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49450

Vulnerability Analysis

The SEPA Girocode plugin generates QR codes and related output for Single Euro Payments Area (SEPA) transactions inside WordPress. The plugin accepts input parameters that are later rendered into HTML output without sufficient sanitization or output encoding. An attacker who can supply values through the plugin's input surface can embed HTML or JavaScript that persists in the database. The payload executes each time the affected page or admin view is loaded by another user.

Because the CVSS vector indicates a scope change and requires user interaction, the impact extends beyond the vulnerable component into the broader WordPress session context. Successful exploitation can lead to administrative account takeover if a privileged user views the injected content.

Root Cause

The root cause is missing or insufficient application of WordPress output-escaping functions such as esc_html(), esc_attr(), or wp_kses() on user-controlled data before it is written to the DOM. Input sanitization on write paths using functions like sanitize_text_field() is also either missing or incomplete for the affected fields.

Attack Vector

Exploitation requires an authenticated user with at least contributor-level privileges to submit crafted input through a plugin field. The payload is stored server-side. When another authenticated user, including an administrator, subsequently loads a page that renders the tainted data, the script executes with that user's privileges within the WordPress origin. Refer to the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-49450

Indicators of Compromise

Presence of <script>, onerror=, onload=, or javascript: strings inside wp_postmeta or wp_options rows related to the sepa-girocode plugin.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading pages containing SEPA Girocode content.
New or modified WordPress administrator accounts created shortly after an administrator viewed a page rendered by the plugin.

Detection Strategies

Audit database entries populated by sepa-girocode for HTML tags, event handlers, and encoded script payloads.
Deploy a Web Application Firewall (WAF) rule set that inspects POST parameters targeting the plugin's endpoints for XSS signatures.
Enable and monitor Content Security Policy (CSP) violation reports to surface unexpected inline script execution on WordPress pages.

Monitoring Recommendations

Log all administrative actions in WordPress and alert on privilege changes, plugin installations, and user creations.
Monitor web server access logs for repeated requests to sepa-girocode admin pages from low-privilege accounts.
Track browser telemetry from privileged users for anomalous script execution or DOM modifications on plugin-rendered pages.

How to Mitigate CVE-2025-49450

Immediate Actions Required

Deactivate the sepa-girocode plugin on all WordPress sites until a patched version is confirmed installed.
Review contributor, author, and editor accounts for unfamiliar users and rotate credentials for privileged accounts.
Purge stored plugin data of any HTML or script content that was not authored by a trusted administrator.

Patch Information

No fixed version has been published in the vendor advisory referenced by NVD at the time of writing. Monitor the Patchstack XSS Vulnerability Advisory and the plugin's WordPress.org page for a release above 0.5.1 that addresses this issue.

Workarounds

Restrict access to the plugin's input fields to trusted administrator accounts only through role management plugins.
Deploy a WAF virtual patch that blocks HTML tags and JavaScript event handlers in POST parameters submitted to sepa-girocode endpoints.
Enforce a strict Content Security Policy that disallows inline scripts across the WordPress admin and public site.

bash

# Example: virtual patch rule (ModSecurity) blocking script payloads to the plugin endpoint
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=sepa-girocode" \
  "id:1004949,phase:2,deny,status:403,log,\
   msg:'CVE-2025-49450 XSS payload blocked',\
   chain"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"