CVE-2025-57950: Plugin Security Scanner Stored XSS Flaw

CVE-2025-57950 Overview

CVE-2025-57950 is a stored Cross-Site Scripting (XSS) vulnerability in the Glen Scott Plugin Security Scanner plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Affected versions include Plugin Security Scanner releases up to and including 2.0.2. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The scope change indicates the injected script can affect resources beyond the vulnerable component's security boundary.

Critical Impact
Stored XSS enables persistent script execution across administrative contexts, potentially leading to session hijacking, credential theft, or unauthorized actions against WordPress administrators.

Affected Products

Glen Scott Plugin Security Scanner plugin for WordPress
All versions from n/a through 2.0.2
WordPress installations using the vulnerable plugin

Discovery Timeline

2025-09-22 - CVE-2025-57950 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57950

Vulnerability Analysis

The Plugin Security Scanner fails to properly sanitize or encode user-controlled input before rendering it within HTML output. This allows an attacker with elevated WordPress privileges to persist malicious script payloads in the plugin's stored data. When another user, typically an administrator, loads the affected page, the browser parses and executes the injected script within the site's origin.

Exploitation requires user interaction, meaning a victim must visit the compromised administrative view for the payload to trigger. Because the scope changes upon exploitation, the payload can influence content and sessions beyond the plugin's immediate boundary. The delivery over the network vector and low attack complexity make the flaw straightforward to weaponize once high-privilege access is obtained.

Root Cause

The underlying defect is the absence of contextual output encoding on stored input rendered by the plugin. WordPress provides sanitization primitives such as esc_html(), esc_attr(), and wp_kses(), but the affected code paths do not apply them consistently before echoing attacker-controlled values into the DOM.

Attack Vector

An attacker with administrative or comparably privileged access to a WordPress site running Plugin Security Scanner ≤ 2.0.2 submits input containing HTML or JavaScript into a field processed by the plugin. The payload is stored server-side. When any user with access to the rendered view opens the page, the browser executes the script in the context of the WordPress admin origin, enabling actions such as cookie exfiltration, forced administrative operations, or persistence via account creation.

No verified proof-of-concept code has been published. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-57950

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored within Plugin Security Scanner database entries or wp_options rows.
Administrator sessions exhibiting unexpected outbound HTTP requests to attacker-controlled domains when browsing plugin-rendered admin pages.
Creation of unauthorized WordPress administrator accounts or unexplained privilege changes shortly after admins access the plugin interface.

Detection Strategies

Inventory WordPress deployments and identify installations of Plugin Security Scanner at version 2.0.2 or earlier.
Inspect plugin-managed database tables and options for HTML control characters, script tags, or encoded payloads that survived storage.
Review browser Content Security Policy (CSP) violation reports for inline script executions originating from /wp-admin/ paths associated with the plugin.

Monitoring Recommendations

Enable and centralize WordPress audit logging to capture plugin configuration changes and privileged user actions.
Monitor web server access logs for administrative POST requests submitting HTML or script payloads to plugin endpoints.
Alert on new administrator account creation, role escalations, and modifications to core WordPress files or wp-config.php.

How to Mitigate CVE-2025-57950

Immediate Actions Required

Update the Glen Scott Plugin Security Scanner plugin to a version later than 2.0.2 once a patched release is available.
If no patched version is available, deactivate and remove the plugin from all WordPress installations.
Rotate WordPress administrator credentials and invalidate active sessions on sites where the plugin has been installed.
Audit user accounts for unauthorized additions or role changes and revert any suspicious modifications.

Patch Information

At the time of the latest NVD update, the vendor advisory listed in the Patchstack Vulnerability Report is the authoritative source for fix availability. Administrators should consult that reference for the current patched version and apply updates through the WordPress plugin manager.

Workarounds

Restrict administrative access to the WordPress backend using IP allowlisting or a web application firewall (WAF) with XSS filtering rules.
Enforce a strict Content Security Policy (CSP) on /wp-admin/ that disallows inline scripts and untrusted origins.
Apply the principle of least privilege by limiting high-privileged accounts and requiring multi-factor authentication for administrators.

bash

# Configuration example: disable and remove the vulnerable plugin via WP-CLI
wp plugin deactivate plugin-security-scanner
wp plugin delete plugin-security-scanner