CVE-2025-50017: WP Voting Contest Stored XSS Vulnerability

CVE-2025-50017 Overview

CVE-2025-50017 is a stored cross-site scripting (XSS) vulnerability in the Matt WP Voting Contest plugin for WordPress (wp-voting-contest). The flaw affects all plugin versions up to and including 5.8. It stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself.

Critical Impact
Attackers with high privileges can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

WP Voting Contest plugin for WordPress
All versions from n/a through 5.8
WordPress sites running the vulnerable wp-voting-contest plugin

Discovery Timeline

2025-06-20 - CVE-2025-50017 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-50017

Vulnerability Analysis

The vulnerability is a stored XSS issue in the WP Voting Contest plugin. The plugin fails to properly sanitize or encode input before rendering it in generated web pages. An attacker with high-privilege access submits a payload containing JavaScript through a plugin input field. The payload is persisted in the WordPress database. On subsequent page loads, the plugin outputs the stored value into HTML context without adequate escaping, causing the browser to execute the attacker-controlled script.

Exploitation requires user interaction, so a targeted victim must load the affected page. Because the vulnerability changes the security scope, the injected script can reach resources beyond the plugin, including WordPress administrative sessions and cookies scoped to the site. Refer to the Patchstack XSS Vulnerability Analysis for additional details.

Root Cause

The root cause is missing output encoding and inadequate input sanitization in the plugin's page generation logic. Untrusted data flows from a plugin input field into HTML output without escaping through functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

The attack vector is network-based. An authenticated attacker with high-privilege plugin access injects a JavaScript payload into a plugin-controlled field. When another user, typically an administrator or contest participant, views the affected page, the stored script executes in their browser context. Consequences include cookie theft, forced administrative actions, and defacement.

No verified public proof-of-concept code is available. See the Patchstack XSS Vulnerability Analysis for the vendor-tracked technical write-up.

Detection Methods for CVE-2025-50017

Indicators of Compromise

Unexpected <script> tags, event handler attributes (for example, onerror, onload), or javascript: URIs stored in wp_posts, wp_postmeta, or plugin-specific tables.
Outbound HTTP requests from browsers loading contest pages to unknown domains, suggesting cookie exfiltration.
New or modified administrator accounts created shortly after a privileged user visited a contest page.

Detection Strategies

Query the WordPress database for plugin-managed content containing HTML tags, event handlers, or encoded script markers.
Enable a Content Security Policy (CSP) in report-only mode to surface unexpected inline scripts on pages rendered by the plugin.
Review WordPress access logs for high-privilege users submitting requests to plugin admin endpoints with suspicious payloads.

Monitoring Recommendations

Monitor plugin-specific admin routes for POST requests containing HTML markup or script keywords.
Alert on modifications to WordPress user roles, options, and administrator accounts following contest page views.
Track browser errors and CSP violation reports originating from pages rendered by wp-voting-contest.

How to Mitigate CVE-2025-50017

Immediate Actions Required

Deactivate the WP Voting Contest plugin on all WordPress sites until a patched version is confirmed available.
Audit high-privilege accounts and rotate credentials for any user who could have injected content through the plugin.
Review existing plugin content for stored JavaScript payloads and remove any malicious entries from the database.

Patch Information

At the time of publication, the advisory lists affected versions from n/a through 5.8 with no fixed version confirmed. Monitor the Patchstack advisory and the plugin's WordPress.org page for an official update. Apply the fixed release as soon as it is published by the vendor.

Workarounds

Restrict plugin administrative access to a minimal set of trusted, high-privilege users.
Deploy a web application firewall (WAF) rule to block requests containing script tags or event handler attributes to plugin admin endpoints.
Enforce a strict Content Security Policy that disallows inline script execution on pages rendered by the plugin.
Remove the plugin entirely if voting contest functionality is not required.

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate wp-voting-contest
wp plugin delete wp-voting-contest