CVE-2025-5239: WordPress Domain For Sale Plugin XSS Flaw

CVE-2025-5239 Overview

The Domain For Sale plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the class_name parameter. The flaw affects all versions up to and including 3.0.10. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. Injected scripts execute in the browser of any user who visits an affected page. This vulnerability is tracked under [CWE-79] and is exploitable over the network. The issue was reported through Wordfence and patched in the plugin trunk via WordPress Changeset 3306141.

Critical Impact
Authenticated Contributor-level users can persistently inject JavaScript that runs against site visitors and administrators, enabling session theft, forced actions, and content defacement.

Affected Products

Domain For Sale plugin for WordPress, versions up to and including 3.0.10
WordPress sites permitting Contributor-level registrations with the plugin installed
Multisite deployments where the plugin is network-activated

Discovery Timeline

2025-06-06 - CVE-2025-5239 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5239

Vulnerability Analysis

The vulnerability resides in the Gutenberg block initialization logic of the Domain For Sale plugin, specifically in Gutenberg_Block_Init.php around line 278. The class_name block attribute is written directly into page markup without sufficient sanitization or output escaping. An attacker with Contributor privileges can craft a post or page containing a Domain For Sale block whose class_name attribute carries HTML or JavaScript payloads. When the page is rendered, the payload executes in the context of the site origin. Because the injection is persistent, every subsequent viewer, including editors and administrators, triggers the payload. This can lead to session hijacking through cookie theft, forced administrative actions via the WordPress REST API, and content injection or defacement across the site.

Root Cause

The root cause is missing input validation and missing output escaping on a user-controllable block attribute. The class_name value should be constrained to a whitelisted character set and passed through esc_attr() before being emitted into HTML. The patched revision in changeset 3306141 addresses the sanitization gap in the Gutenberg block renderer.

Attack Vector

Exploitation requires authenticated access at Contributor level or higher, which is a low privilege tier on many WordPress sites that accept guest authors. The attacker inserts a Domain For Sale Gutenberg block into a draft post and populates class_name with a payload that breaks out of the attribute context. Once an editor previews or an administrator reviews the submission, or the post is published and visited, the script executes. No user interaction beyond visiting the injected page is required for exploitation.

See the WordPress Gutenberg Block Code reference and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-5239

Indicators of Compromise

Domain For Sale Gutenberg blocks whose className attribute contains angle brackets, quote characters, or on* event handlers
Post revisions authored by Contributor accounts that introduce script fragments into block attributes
Unexpected outbound requests from browser sessions of administrators after viewing plugin-rendered pages
New administrator accounts or role changes created shortly after a Contributor submission is reviewed

Detection Strategies

Query the wp_posts table for post_content entries containing the Domain For Sale block marker combined with suspicious className values
Review web server access logs for POST requests to wp-admin/post.php and wp-json/wp/v2/posts from Contributor accounts that include script-like payloads
Compare plugin file hashes against the fixed release to confirm the patched version is deployed

Monitoring Recommendations

Alert on creation or role elevation of WordPress accounts following Contributor content submissions
Monitor Content Security Policy violation reports for inline script execution on plugin-rendered pages
Track administrator session activity for anomalous REST API calls that follow page views

How to Mitigate CVE-2025-5239

Immediate Actions Required

Update the Domain For Sale plugin to a version newer than 3.0.10 that incorporates changeset 3306141
Audit all posts and pages containing Domain For Sale blocks and remove or sanitize any className values that contain HTML or JavaScript
Restrict Contributor-level registrations on sites where untrusted authors are not required
Rotate administrator session cookies and reset passwords if evidence of exploitation is found

Patch Information

The vendor addressed the issue in WordPress Changeset 3306141. Refer to the WordPress Plugin Developer Info page for the current release version and changelog. Site administrators should upgrade through the WordPress admin dashboard or via WP-CLI.

Workarounds

Deactivate and remove the Domain For Sale plugin until it can be updated
Restrict the Contributor role from using the Domain For Sale block through a capability management plugin
Deploy a Web Application Firewall rule that blocks POST bodies containing the block signature combined with script-like className values
Enforce a strict Content Security Policy that disallows inline scripts on the front end

bash

# Update the plugin via WP-CLI
wp plugin update domain-for-sale

# Verify installed version
wp plugin get domain-for-sale --field=version

# Temporarily deactivate if a patched build is not yet available
wp plugin deactivate domain-for-sale