CVE-2025-58267 Overview
CVE-2025-58267 is a Cross-Site Request Forgery (CSRF) vulnerability in the Aftabul Islam Stock Message plugin for WordPress. The flaw affects all versions of the stock-message plugin up to and including 1.1.0. Attackers can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload to persist malicious JavaScript in plugin-controlled content. Exploitation requires a logged-in privileged user to visit an attacker-controlled page or click a crafted link. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
A successful attack stores attacker-controlled JavaScript in the WordPress site, which executes against any visitor or administrator who loads the affected page, enabling session theft, account takeover, and further site compromise.
Affected Products
- Aftabul Islam Stock Message WordPress plugin (stock-message)
- All versions from initial release through 1.1.0
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-09-22 - CVE-2025-58267 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-58267
Vulnerability Analysis
The Stock Message plugin exposes state-changing administrative actions without validating an anti-CSRF token. When an authenticated administrator visits an attacker-controlled page, the browser submits a forged request to the WordPress site using the admin's existing session. The plugin processes the request as legitimate and writes attacker-supplied input into stored plugin settings.
The stored input is later rendered in the browser without proper output encoding, producing a Stored XSS condition. The two weaknesses combine into a single exploit chain: CSRF delivers the payload, and Stored XSS executes it. The attack requires user interaction, but the scope changes once the script runs in the context of the WordPress origin.
Because the payload persists in the database, every subsequent page load that includes the affected content triggers script execution. This expands impact beyond the original victim to any administrator or visitor who views the compromised page.
Root Cause
The plugin fails to implement WordPress nonce verification using wp_verify_nonce() or check_admin_referer() on its settings handlers. It also does not sanitize input with functions such as sanitize_text_field() or escape output with esc_html() and esc_attr() before rendering. The combination of missing CSRF protection and missing output encoding produces the chained CSRF-to-Stored-XSS condition.
Attack Vector
The attack is network-reachable and requires user interaction from a privileged WordPress user. An attacker hosts a malicious page containing an auto-submitting form or JavaScript that targets the vulnerable plugin endpoint. When an authenticated administrator visits the page, the browser issues the forged request, and the plugin stores the XSS payload. Refer to the Patchstack advisory for vulnerability details.
Detection Methods for CVE-2025-58267
Indicators of Compromise
- Unexpected <script>, onerror, or onload strings in Stock Message plugin database options or settings tables
- WordPress administrator sessions making POST requests to Stock Message admin endpoints from external referrers
- Outbound requests from administrator browsers to unknown domains shortly after visiting plugin pages
- New or modified administrator accounts created without a corresponding legitimate workflow
Detection Strategies
- Audit the wp_options table for entries owned by the Stock Message plugin containing HTML or JavaScript syntax
- Review web server access logs for POST requests to plugin endpoints with Referer headers pointing to external sites
- Inspect rendered plugin output in browser developer tools for injected <script> tags or event handlers
- Compare installed plugin file hashes against a known-good copy of the official release
Monitoring Recommendations
- Enable WordPress audit logging to track plugin option changes and administrator activity
- Alert on any administrator-authenticated request whose Referer is not the site's own domain
- Monitor for outbound HTTP requests from admin browser sessions to non-allowlisted hosts
- Track plugin version inventory across WordPress instances and flag any running stock-message <= 1.1.0
How to Mitigate CVE-2025-58267
Immediate Actions Required
- Deactivate and remove the Stock Message plugin until a patched version is published
- Audit the WordPress database for stored JavaScript payloads in plugin-controlled options and remove them
- Force a password reset and session invalidation for all administrator accounts
- Review administrator and user accounts for unauthorized additions or privilege changes
Patch Information
At the time of publication, no fixed version is listed in the Patchstack advisory. All versions through 1.1.0 remain vulnerable. Monitor the WordPress plugin repository for an updated release and apply it immediately when available.
Workarounds
- Uninstall the stock-message plugin entirely if business requirements allow
- Restrict access to the WordPress admin interface using IP allowlisting at the web server or WAF layer
- Deploy a Content Security Policy (CSP) that blocks inline scripts to limit Stored XSS execution
- Require administrators to use a dedicated browser profile and log out of WordPress before browsing other sites
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate stock-message
wp plugin uninstall stock-message
# Verify removal
wp plugin list | grep stock-message
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
