CVE-2025-58265: Events Manager OpenStreetMaps XSS Vulnerability

CVE-2025-58265 Overview

CVE-2025-58265 is a stored cross-site scripting (XSS) vulnerability in the Stonehenge Creations Events Manager – OpenStreetMaps WordPress plugin (stonehenge-em-osm). The flaw affects all plugin versions up to and including 4.2.1. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The vulnerability is classified as improper neutralization of input during web page generation [CWE-79].

Critical Impact
Authenticated attackers can inject stored JavaScript that executes in visitor and administrator browsers, enabling session theft, forced actions, and site defacement across a scope-changed boundary.

Affected Products

Stonehenge Creations Events Manager – OpenStreetMaps plugin for WordPress
All versions from initial release through 4.2.1
WordPress sites where the stonehenge-em-osm plugin is installed and active

Discovery Timeline

2025-09-22 - CVE-2025-58265 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58265

Vulnerability Analysis

The vulnerability stems from missing output encoding when the plugin renders user-supplied input into WordPress-generated HTML. Input processed by the plugin is stored in the database and later returned to page viewers without sanitization or contextual escaping. Because the payload persists, every subsequent request that loads the affected view triggers script execution in the victim's browser.

Exploitation requires authenticated access with low privileges and user interaction to trigger the stored payload. The scope-changed impact means injected script executes under the origin of the WordPress site and can affect users beyond the attacker's own account, including administrators viewing plugin-managed content.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin fails to apply WordPress escaping primitives such as esc_html(), esc_attr(), or wp_kses_post() to fields rendered into the DOM. Data flows from an authenticated input surface into database storage and then to page output without validation against an allowlist of safe characters or HTML contexts.

Attack Vector

An attacker with an authenticated low-privilege account submits a crafted payload containing HTML or JavaScript through an input field exposed by the plugin. The payload is stored in WordPress database tables. When another user, including a site administrator, loads a page that renders the poisoned field, the browser parses and executes the injected script. Common attack outcomes include session cookie exfiltration, forced privileged actions via authenticated fetch calls, redirect chains to attacker infrastructure, and injection of secondary payloads.

No verified public proof-of-concept code is available. Refer to the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-58265

Indicators of Compromise

Unexpected <script>, <svg>, onerror=, or onload= fragments stored in WordPress wp_postmeta or plugin-specific tables
Outbound browser requests from authenticated admin sessions to unfamiliar external domains following page loads that render plugin content
New or modified WordPress administrator accounts appearing shortly after low-privileged users interact with plugin forms
Anomalous cookie or credential access patterns in browser telemetry when viewing pages containing OpenStreetMaps plugin output

Detection Strategies

Audit plugin-controlled database fields for HTML control characters and encoded JavaScript keywords
Deploy a web application firewall rule set that inspects POST bodies to plugin endpoints for XSS signatures
Enable a strict Content Security Policy in report-only mode to surface unexpected inline script execution on pages that embed the plugin
Correlate WordPress access logs for low-privilege users submitting content to plugin endpoints followed by administrator page views

Monitoring Recommendations

Alert on modifications to plugin-managed posts or metadata performed by non-administrator accounts
Monitor administrator sessions for unexpected privileged REST API calls originating from browser context
Review WordPress audit logs weekly for new user registrations, role changes, and plugin configuration edits

How to Mitigate CVE-2025-58265

Immediate Actions Required

Identify all WordPress sites running the stonehenge-em-osm plugin and inventory active versions
Deactivate the plugin on sites running version 4.2.1 or earlier until a patched release is confirmed installed
Rotate WordPress administrator passwords and invalidate active sessions if suspicious stored content is discovered
Review recent contributor and author account activity for unauthorized submissions to plugin-managed content

Patch Information

At the time of publication, no fixed version is identified in the NVD record. Monitor the Patchstack XSS Vulnerability Advisory and the plugin repository for a patched release above version 4.2.1 and apply it as soon as it becomes available.

Workarounds

Restrict plugin content submission privileges to trusted administrator accounts only
Deploy a virtual patch through a WordPress-aware WAF to block script tag patterns in requests targeting plugin endpoints
Enforce a Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Remove or replace the plugin with a maintained alternative if a fix is not released in a timely manner

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate stonehenge-em-osm
wp plugin status stonehenge-em-osm