CVE-2025-53338 Overview
CVE-2025-53338 is a Cross-Site Request Forgery (CSRF) vulnerability in the re.place WordPress plugin developed by dor. The flaw affects all versions up to and including 0.2.1. Successful exploitation chains CSRF with Stored Cross-Site Scripting (XSS), allowing an attacker to persist malicious script content in the application after tricking an authenticated user into visiting a crafted page.
The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Reference details are published in the Patchstack WordPress Plugin Vulnerability database.
Critical Impact
An attacker can forge state-changing requests that inject persistent JavaScript into the WordPress site, leading to session theft, content manipulation, or further compromise of site visitors and administrators.
Affected Products
- WordPress re.place plugin by dor
- Versions through 0.2.1
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-06-27 - CVE-2025-53338 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-53338
Vulnerability Analysis
The re.place plugin processes state-changing requests without verifying a valid anti-CSRF token. WordPress provides a nonce mechanism through wp_nonce_field() and check_admin_referer(), but the affected endpoints do not enforce nonce validation. An attacker can craft an HTML page or image tag that triggers a forged request when an authenticated administrator visits it.
Because the forged request writes attacker-controlled input into stored content without sanitization, the CSRF flaw chains directly into Stored XSS. The injected payload persists in the database and executes in the browser of any user who later renders the affected page. The combined attack expands impact across confidentiality, integrity, and availability of the WordPress instance.
The EPSS score is 0.08%, reflecting low observed exploitation activity at the time of analysis. However, CSRF chained with Stored XSS in WordPress plugins is a recurring exploitation pattern targeting administrative sessions.
Root Cause
The root cause is missing CSRF protection [CWE-352] on plugin endpoints that accept and store user-supplied content. The plugin does not validate WordPress nonces, and it does not sanitize or escape stored values before rendering them as HTML.
Attack Vector
Exploitation requires an authenticated WordPress user, typically an administrator, to visit a malicious page while logged in. The browser automatically attaches authentication cookies to the forged request. The request stores attacker-controlled JavaScript in the plugin's content store. When the affected page is rendered, the script executes in the victim's browser context. See the Patchstack advisory for additional technical context.
Detection Methods for CVE-2025-53338
Indicators of Compromise
- Unexpected <script> tags, event handlers, or obfuscated JavaScript in plugin-managed content fields stored in the WordPress database
- HTTP POST requests to re.place plugin endpoints lacking a valid _wpnonce parameter or with Referer headers pointing to external domains
- Administrator sessions performing content modifications immediately after browsing external URLs
Detection Strategies
- Review WordPress wp_posts, wp_postmeta, and plugin-specific tables for stored HTML containing script payloads or external resource references
- Inspect web server access logs for state-changing requests to plugin admin endpoints originating from cross-origin referrers
- Run static scans of the re.place plugin source for handlers that omit check_admin_referer() or wp_verify_nonce() calls
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) rule set that flags POST requests to wp-admin endpoints missing nonce parameters
- Alert on administrator account activity that follows a browser navigation event to an untrusted external site
- Monitor outbound requests from the WordPress server and from client browsers loading admin pages for connections to unknown domains
How to Mitigate CVE-2025-53338
Immediate Actions Required
- Deactivate and remove the re.place plugin from all WordPress installations until a patched version is confirmed available
- Audit existing plugin-managed content for injected scripts and remove any unauthorized HTML
- Force a password reset and session invalidation for all administrator accounts that may have visited untrusted sites while authenticated
Patch Information
No fixed version is identified in the public advisory at the time of writing. The vulnerability affects re.place versions through 0.2.1. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release.
Workarounds
- Restrict access to the WordPress admin interface using IP allowlists or VPN-only access for administrators
- Deploy a Content Security Policy (CSP) header that blocks inline scripts and limits script sources to trusted origins
- Require administrators to use a dedicated, hardened browser profile that is not used for general web browsing
- Apply a WAF rule that rejects POST requests to plugin endpoints when the Referer header does not match the site origin
# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate replace
wp plugin delete replace
# Verify removal
wp plugin list --status=active | grep -i replace
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
