CVE-2025-50016: IP Based Login Stored XSS Vulnerability

CVE-2025-50016 Overview

CVE-2025-50016 is a stored Cross-Site Scripting (XSS) vulnerability in the brijeshk89 IP Based Login plugin for WordPress. The flaw affects all versions of ip-based-login up to and including 2.4.2. The issue stems from improper neutralization of user-supplied input during web page generation, tracked under CWE-79.

An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page. Because the injected script executes in a scope change (S:C), the impact reaches beyond the vulnerable component into the victim's browser session.

Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account takeover through malicious scripts persisted in the WordPress database.

Affected Products

brijeshk89 IP Based Login WordPress plugin
All versions from n/a through 2.4.2
WordPress sites running the ip-based-login plugin

Discovery Timeline

2025-06-20 - CVE-2025-50016 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50016

Vulnerability Analysis

The vulnerability resides in the IP Based Login plugin, which restricts WordPress logins based on client IP address. The plugin fails to sanitize input before rendering it in the web interface. An attacker submits crafted input containing HTML or JavaScript, which the plugin stores and later returns to browsers without encoding.

Exploitation requires authenticated access with elevated privileges and user interaction to trigger the payload. Once triggered, the script runs in the context of the WordPress site. Attackers can steal session cookies, perform actions on behalf of administrators, or pivot into further compromise of the site.

The stored nature of the flaw makes it more persistent than reflected XSS. Every subsequent visit to the affected page re-executes the injected payload until an administrator removes it from the database.

Root Cause

The root cause is missing output encoding and input sanitization in the plugin's admin-facing components. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for context-appropriate escaping. The plugin does not apply these when rendering stored values back to the page.

Attack Vector

The attack vector is network-based and requires an authenticated account with high privileges within the WordPress installation. The attacker submits a payload through an input field processed by the plugin. The payload is persisted and later executed when a victim, typically another administrator, loads the affected page.

See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-50016

Indicators of Compromise

Unexpected <script>, <iframe>, or on*= event handler content stored in WordPress plugin option tables
Unusual outbound requests from administrator browsers to attacker-controlled domains after visiting plugin pages
Newly created WordPress administrator accounts or modified user roles following visits to plugin admin pages

Detection Strategies

Inventory WordPress sites for the ip-based-login plugin and confirm installed versions against 2.4.2 or earlier
Review the WordPress database, particularly wp_options and plugin-specific tables, for HTML or JavaScript tokens in stored plugin values
Correlate web server access logs with administrator sessions to identify anomalous POST requests to plugin endpoints

Monitoring Recommendations

Enable web application firewall (WAF) logging for administrator paths under /wp-admin/ and flag payloads containing script tags
Monitor authenticated administrator activity for content-injection patterns and unexpected role changes
Alert on JavaScript execution originating from admin interfaces that contacts external domains

How to Mitigate CVE-2025-50016

Immediate Actions Required

Identify all WordPress installations running the IP Based Login plugin at version 2.4.2 or earlier
Deactivate the plugin until a fixed version is confirmed and installed
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected
Review the plugin's stored configuration for injected HTML or JavaScript and remove offending entries

Patch Information

At the time of publication, no fixed version is documented in the NVD entry. Consult the Patchstack Vulnerability Report for the latest remediation status and any vendor-supplied update.

Workarounds

Restrict administrator access to trusted IP ranges through the web server or WAF while a patch is unavailable
Enforce a strict Content Security Policy (CSP) that blocks inline scripts on WordPress admin pages
Limit high-privilege WordPress accounts and require multi-factor authentication for all administrators
Remove the plugin entirely if the functionality is not required for site operation

bash

# Example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate ip-based-login
wp plugin status ip-based-login