CVE-2025-57911: WPFactory Adverts Click Tracker XSS Flaw

CVE-2025-57911 Overview

CVE-2025-57911 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WPFactory Adverts Click Tracker plugin for WordPress (adverts-click-tracker). The flaw affects all plugin versions up to and including 1.4. It stems from improper neutralization of input during web page generation, tracked as [CWE-79]. An attacker can inject malicious script content that executes in a victim's browser within the context of the affected WordPress site. Exploitation requires low privileges and user interaction, and the impact crosses a security scope boundary, affecting confidentiality, integrity, and availability at a limited level.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure.

Affected Products

• WPFactory Adverts Click Tracker plugin for WordPress
• All versions from initial release through 1.4
• WordPress sites with the adverts-click-tracker plugin installed and active

Discovery Timeline

• 2025-09-22 - CVE-2025-57911 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57911

Vulnerability Analysis

The vulnerability is a DOM-Based Cross-Site Scripting flaw in the client-side logic of the Adverts Click Tracker plugin. DOM-Based XSS occurs when JavaScript running in the browser reads attacker-controlled data from a source such as location, document.referrer, or postMessage, and passes it to a sink such as innerHTML, document.write, or eval without sanitization. Because the injection occurs in the DOM at runtime, the malicious payload may never appear in the HTTP response body, which can bypass server-side detection controls.

An attacker crafts a URL or interaction that delivers a script payload to the vulnerable client-side handler. When a user with an active session visits the crafted resource and completes the required interaction, the script executes with the privileges of that user in the site's origin.

Root Cause

The plugin fails to properly neutralize input before writing it into the Document Object Model. Data flowing from an attacker-controlled source into a DOM sink is treated as trusted markup rather than as inert text. This allows arbitrary JavaScript to execute within the site's origin.

Attack Vector

Exploitation requires network access to the vulnerable site, an authenticated session with low-level privileges, and user interaction to trigger the malicious payload. The scope is changed, meaning the executed script can affect resources beyond the initially vulnerable component, including other users' sessions within the WordPress environment.

No verified proof-of-concept code has been published. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-57911

Indicators of Compromise

• Unexpected <script> tags, event handlers, or javascript: URIs in stored plugin data or click-tracking parameters
• Outbound browser requests from WordPress user sessions to unknown domains following interaction with advert links
• Anomalous session token usage or administrator actions initiated from unusual IP addresses shortly after users interact with tracked ads

Detection Strategies

• Inventory WordPress installations and identify sites running adverts-click-tracker version 1.4 or earlier
• Review web server and WordPress access logs for requests containing script fragments, encoded angle brackets, or suspicious query parameters targeting plugin endpoints
• Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution within pages that load the plugin

Monitoring Recommendations

• Alert on modifications to plugin files or WordPress options tables associated with adverts-click-tracker
• Monitor for the creation of new WordPress administrator accounts or privilege changes following user interaction with advert-tracking URLs
• Track browser console errors and CSP violation reports that reference the plugin's JavaScript assets

How to Mitigate CVE-2025-57911

Immediate Actions Required

• Identify all WordPress instances running the WPFactory Adverts Click Tracker plugin at version 1.4 or earlier
• Deactivate the plugin until a patched version is confirmed available and installed
• Rotate credentials and session tokens for administrators who may have interacted with untrusted advert links

Patch Information

At the time of publication, the vendor advisory referenced by Patchstack lists affected versions up to and including 1.4. Administrators should upgrade to the latest version released by WPFactory that addresses this issue and verify the fix through the plugin's changelog.

Workarounds

• Deactivate and remove the adverts-click-tracker plugin until a verified patched release is deployed
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Restrict low-privileged WordPress accounts and require multi-factor authentication for all users who can interact with plugin functionality

# Configuration example: strict CSP header to reduce XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"