CVE-2025-58235: Front End Users Stored XSS Vulnerability

CVE-2025-58235 Overview

CVE-2025-58235 is a stored cross-site scripting (XSS) vulnerability in the Rustaurius Front End Users plugin for WordPress, tracked under [CWE-79]. The flaw affects all plugin versions up to and including 3.2.35. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. Because the vulnerability crosses a security boundary (scope changed), the impact reaches beyond the vulnerable component.

Critical Impact
Authenticated attackers can store malicious scripts that execute in other users' sessions, enabling session theft, account takeover, and defacement across the WordPress site.

Affected Products

Rustaurius Front End Users (front-end-only-users) plugin for WordPress
All versions from initial release through 3.2.35
WordPress sites using the plugin for front-end user registration and profile management

Discovery Timeline

2025-09-22 - CVE CVE-2025-58235 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58235

Vulnerability Analysis

The Front End Users plugin fails to properly neutralize user-supplied input before rendering it during web page generation. The plugin stores attacker-controlled data and later reflects it into HTML responses without adequate sanitization or output encoding. This allows persistent script injection that executes whenever a victim loads the affected page.

Exploitation requires authentication with low privileges and involves user interaction to trigger the payload. A successful attack can hijack sessions, exfiltrate cookies, perform actions on behalf of authenticated users, or pivot to administrative accounts if an admin views the injected content.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin accepts data through front-end user forms or profile fields and writes that data into pages without applying context-appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses(). Stored payloads persist in the WordPress database and execute on every subsequent page view.

Attack Vector

An authenticated attacker submits a crafted payload through a plugin-exposed input field. The payload is stored server-side and rendered into the DOM of another user's browser session. When an administrator or other privileged user views the affected content, the script executes in their authenticated context. See the Patchstack Vulnerability Report for additional technical detail.

// No verified proof-of-concept code is publicly available for this CVE.
// Refer to the Patchstack advisory linked above for further technical detail.

Detection Methods for CVE-2025-58235

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in WordPress user profile fields or plugin-managed database tables.
Outbound requests from administrator browser sessions to unknown domains shortly after viewing user-generated content.
New administrator accounts, modified user roles, or unexplained plugin installations following authenticated user activity.

Detection Strategies

Query the WordPress database for HTML or JavaScript patterns in wp_usermeta and plugin-specific tables associated with the Front End Users plugin.
Deploy a Web Application Firewall (WAF) rule set that flags XSS payload signatures in POST requests to plugin endpoints.
Monitor WordPress audit logs for suspicious profile updates originating from low-privilege accounts.

Monitoring Recommendations

Enable browser Content Security Policy (CSP) reporting to capture blocked script execution attempts.
Track plugin version inventory across WordPress deployments to identify hosts still running 3.2.35 or earlier.
Alert on administrator session anomalies such as unusual API calls or configuration changes following content views.

How to Mitigate CVE-2025-58235

Immediate Actions Required

Update the Front End Users plugin to a version later than 3.2.35 as soon as the vendor publishes a fixed release.
Audit existing user profile data and plugin-managed content for injected script payloads and remove any malicious entries.
Rotate credentials and session tokens for administrator accounts if compromise is suspected.

Patch Information

At the time of publication, the Patchstack advisory confirms all versions through 3.2.35 are affected. Administrators should monitor the plugin's official release channel for a patched version and apply it immediately upon availability.

Workarounds

Disable the Front End Users plugin until a patched version is available if front-end user registration is not business-critical.
Restrict low-privilege user registration and require administrator approval before new accounts can submit profile data.
Deploy a WAF rule to block requests containing common XSS payload patterns targeting plugin endpoints.

bash

# Example WAF rule pattern (ModSecurity) to block XSS payloads on plugin endpoints
SecRule REQUEST_URI "@contains /front-end-only-users/" \
  "chain,deny,status:403,id:1005823,msg:'Blocked potential XSS payload'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)"