CVE-2025-57928: AWP Classifieds XSS Vulnerability

CVE-2025-57928 Overview

CVE-2025-57928 is a Basic Cross-Site Scripting (XSS) vulnerability affecting the Strategy11 Team AWP Classifieds plugin (another-wordpress-classifieds-plugin) for WordPress. The flaw stems from improper neutralization of script-related HTML tags in a web page, allowing attackers to inject content into rendered pages. The issue affects all versions of AWP Classifieds up to and including 4.4.3. The vulnerability is categorized under [CWE-80] and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can inject script-related HTML content into WordPress pages served by the AWP Classifieds plugin, leading to limited confidentiality impact on site visitors.

Affected Products

Strategy11 Team AWP Classifieds (another-wordpress-classifieds-plugin)
All versions from n/a through 4.4.3
WordPress installations with the plugin enabled

Discovery Timeline

2025-09-22 - CVE-2025-57928 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57928

Vulnerability Analysis

CVE-2025-57928 is a Basic XSS flaw classified under [CWE-80]: Improper Neutralization of Script-Related HTML Tags in a Web Page. The AWP Classifieds plugin fails to properly sanitize or encode user-supplied input before it is rendered within HTML output. As a result, script-related HTML tags submitted by an attacker are preserved in the response body and interpreted by the victim's browser.

This type of XSS enables code injection into the browser context of any user viewing an affected page. Attackers can execute arbitrary JavaScript to steal session tokens, redirect users, or manipulate DOM content. The attack requires no authentication and no user interaction beyond visiting the affected page.

The EPSS score for this vulnerability is 0.294%, placing it in the 21.236 percentile for likelihood of exploitation. No public proof-of-concept exploit has been published, and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient output encoding of user-supplied data in the AWP Classifieds plugin. Input containing HTML tags related to scripting is stored or reflected without neutralization. When the affected page renders, the browser parses and executes the injected markup as part of the trusted origin.

Attack Vector

The attack vector is network-based. An attacker crafts a payload containing script-related HTML tags and delivers it through a plugin input field or URL parameter that is later rendered on a public-facing page. When a victim loads the page, the injected content executes in their browser session. No privileges or user interaction are required to place the payload beyond standard plugin functionality.

Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-57928

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes stored in AWP Classifieds listing fields or database tables
Outbound requests from visitor browsers to unfamiliar domains after loading classifieds pages
Unusual JavaScript errors or console warnings on pages rendered by the plugin

Detection Strategies

Scan the WordPress database for entries containing HTML tags such as <script, onerror=, onload=, or javascript: within AWP Classifieds tables
Review web server access logs for POST requests to plugin endpoints containing encoded script payloads
Perform periodic content integrity checks against classifieds listings for unauthorized HTML markup

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to detect script execution from unexpected sources
Monitor WordPress audit logs for anomalous content submissions to AWP Classifieds forms
Alert on Web Application Firewall (WAF) rules matching common XSS payload patterns targeting the plugin path

How to Mitigate CVE-2025-57928

Immediate Actions Required

Identify all WordPress installations running AWP Classifieds version 4.4.3 or earlier
Update the plugin to a version above 4.4.3 once the vendor releases a patched build
Audit existing classifieds content for stored malicious HTML and remove injected payloads
Restrict submission of classifieds content to trusted, authenticated users where feasible

Patch Information

AWP Classifieds versions through 4.4.3 are affected. Administrators should consult the Patchstack Vulnerability Report and the Strategy11 vendor page for the current fixed release and upgrade instructions.

Workarounds

Deploy a Web Application Firewall rule to block requests containing script-related HTML tags targeting AWP Classifieds endpoints
Disable the AWP Classifieds plugin until a patched version can be applied if active exploitation is suspected
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Example WAF rule (ModSecurity) to block script tags in AWP Classifieds requests
SecRule REQUEST_URI "@contains /awpcp" \
  "chain,deny,status:403,id:1057928,msg:'Block XSS payload targeting AWP Classifieds CVE-2025-57928'"
SecRule ARGS "@rx (?i)<\s*script|onerror\s*=|onload\s*=|javascript:" "t:none,t:urlDecodeUni"