CVE-2025-58237: LC Wizard ghl-wizard Stored XSS Vulnerability

CVE-2025-58237 Overview

CVE-2025-58237 is a stored cross-site scripting (XSS) vulnerability in the Niaj Morshed LC Wizard (ghl-wizard) WordPress plugin. The flaw affects all versions from initial release through 2.2.4. It stems from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79]. Authenticated attackers with low privileges can inject malicious JavaScript that persists in the plugin's stored content. The payload executes in the browser of any user who views the affected page, including administrators. Successful exploitation can lead to session hijacking, credential theft, and unauthorized administrative actions within the WordPress environment.

Critical Impact
Stored XSS enables authenticated low-privilege users to persist JavaScript payloads that execute in administrator browsers, changing the security scope of the compromise.

Affected Products

Niaj Morshed LC Wizard (ghl-wizard) WordPress plugin
All versions up to and including 2.2.4
WordPress sites with the LC Wizard plugin installed and activated

Discovery Timeline

2025-09-22 - CVE-2025-58237 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58237

Vulnerability Analysis

The LC Wizard plugin accepts user-controlled input and renders it into web pages without adequate output encoding or sanitization. Because the payload is stored server-side, it executes each time a victim loads the affected page. The attack requires an authenticated account with low privileges and one user interaction to trigger execution. The scope changes from the attacker's context to the victim's context, meaning payloads submitted by contributor-level accounts can run inside an administrator session. This crosses a trust boundary and enables actions the original attacker cannot perform directly.

Root Cause

The root cause is missing input validation and output escaping in the plugin's handling of user-supplied fields. WordPress provides sanitization helpers such as sanitize_text_field(), wp_kses_post(), and esc_html(), but the vulnerable code paths in ghl-wizard do not apply them before storing or rendering data. As a result, HTML and JavaScript submitted through legitimate plugin inputs are preserved verbatim and inserted into the DOM.

Attack Vector

An attacker authenticates to the target WordPress instance with any account that has access to the vulnerable plugin functionality. The attacker submits a crafted payload containing JavaScript through an input field that LC Wizard renders back to other users. When an administrator or other privileged user visits the affected view, the browser parses and executes the injected script under the site's origin. Common outcomes include stealing authentication cookies, creating rogue administrator accounts, planting backdoors in theme or plugin files, and pivoting to other web-facing systems.

See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-58237

Indicators of Compromise

Unexpected <script>, onerror=, or onload= fragments stored in WordPress database tables associated with LC Wizard
New or modified administrator accounts created shortly after low-privilege users interacted with the plugin
Outbound requests from browser sessions to attacker-controlled domains referenced in stored plugin content
Unexplained edits to WordPress theme or plugin files following administrator visits to plugin-rendered pages

Detection Strategies

Query the WordPress database for LC Wizard entries containing HTML event handlers or <script substrings
Enable and review WordPress audit logging for content changes made by non-administrator roles
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations tied to the plugin's pages

Monitoring Recommendations

Alert on creation of new administrator users or role escalations following plugin activity
Monitor web server access logs for repeated POST requests to LC Wizard endpoints from low-privilege accounts
Track browser telemetry or WAF logs for outbound requests to unfamiliar domains originating from /wp-admin sessions

How to Mitigate CVE-2025-58237

Immediate Actions Required

Update the LC Wizard (ghl-wizard) plugin to a version later than 2.2.4 as soon as a fixed release is available
Deactivate and remove the plugin if a patched version is not yet published and the functionality is not essential
Audit user accounts and revoke unnecessary editing privileges from non-administrator roles
Rotate administrator passwords and invalidate active WordPress sessions if compromise is suspected

Patch Information

Refer to the Patchstack XSS Vulnerability Advisory for current patch status. Apply vendor updates through the WordPress plugin manager once released and verify the installed version afterward.

Workarounds

Restrict access to LC Wizard functionality to trusted administrator accounts only
Deploy a web application firewall rule to block requests containing script tags or JavaScript event handlers targeting the plugin's endpoints
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and plugin-rendered pages
Remove any stored plugin content that contains untrusted HTML until a patched version is installed

bash

# Example WordPress-CLI commands to audit and disable the plugin
wp plugin list --name=ghl-wizard --fields=name,status,version
wp plugin deactivate ghl-wizard
wp user list --role=administrator --fields=ID,user_login,user_registered