CVE-2025-5845: Affiliate Reviews WordPress Plugin XSS Flaw

CVE-2025-5845 Overview

CVE-2025-5845 is a Stored Cross-Site Scripting (XSS) vulnerability in the Affiliate Reviews plugin for WordPress. The flaw affects all versions up to and including 1.0.6. The plugin fails to properly sanitize input and escape output for the numColumns parameter in the reviews grid block template. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who visits an affected page. The vulnerability is tracked as [CWE-79] and requires low privileges but no user interaction beyond page access.

Critical Impact
Contributor-level users can inject persistent JavaScript that executes against administrators and site visitors, enabling session hijacking, credential theft, and further site compromise.

Affected Products

Affiliate Reviews plugin for WordPress
All versions up to and including 1.0.6
Sites allowing Contributor-level or higher registration

Discovery Timeline

2025-07-16 - CVE-2025-5845 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5845

Vulnerability Analysis

The vulnerability resides in the Affiliate Reviews plugin's block template block-reviews-grid-style.php. The numColumns parameter, supplied through block attributes, is rendered into page output without sufficient sanitization or escaping. An authenticated attacker with Contributor privileges can craft a post or block containing malicious values for numColumns. When the affected page is rendered, the injected script executes in the browser session of any visitor, including administrators.

Stored XSS in WordPress plugins is a recurring class of issue. Contributor accounts are typically permitted to create draft content, which lowers the barrier for exploitation on sites that accept user registrations or contributor submissions. The scope changes from the vulnerable component to the browser context of victims, which is why the CVSS scope flag is set to changed.

Root Cause

The root cause is missing input sanitization on the numColumns block attribute combined with missing output escaping when the value is written into the rendered HTML. WordPress provides functions such as esc_attr(), esc_html(), and absint() for this purpose. The template omitted these calls, allowing arbitrary characters to reach the DOM.

Attack Vector

An attacker authenticates as a Contributor, then inserts or edits a reviews grid block with a malicious payload placed in the numColumns attribute. The payload persists in the post content. When any user renders the page, the browser parses and executes the injected script under the site's origin. Consequences include administrator session theft, forced actions via the admin interface, and drive-by redirection.

See the WordPress Block Code Review and the Wordfence Vulnerability Report for technical references.

Detection Methods for CVE-2025-5845

Indicators of Compromise

Post or page content containing <script>, onerror=, onload=, or javascript: payloads within reviews grid block attributes.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains after visiting posts using the plugin's block.
New or modified administrator accounts created shortly after a Contributor account edits reviews grid content.
Contributor accounts editing or publishing posts that include the affiliate-reviews grid block.

Detection Strategies

Scan the wp_posts table for reviews grid block markup containing suspicious characters in the numColumns attribute.
Inspect web server access logs for POST requests to /wp-admin/post.php and /wp-json/wp/v2/* from Contributor-level accounts.
Deploy a Web Application Firewall (WAF) rule that blocks script tags and event handlers submitted through block attributes.

Monitoring Recommendations

Alert on creation or privilege changes for accounts that recently submitted content to plugins using vulnerable block templates.
Log and review Content Security Policy (CSP) violation reports from the WordPress admin origin.
Track plugin file modifications and correlate with the vendor patch identifier Changeset #3345717.

How to Mitigate CVE-2025-5845

Immediate Actions Required

Update the Affiliate Reviews plugin to a version newer than 1.0.6 that includes the fix from WordPress Changeset #3345717.
Audit existing posts using the reviews grid block for injected script content and remove malicious payloads.
Rotate credentials and session tokens for administrator accounts that may have viewed compromised pages.
Review Contributor and Author accounts for unexpected activity or privilege escalation.

Patch Information

The vendor released a fix through WordPress Changeset #3345717. Site operators should install the patched release from the WordPress Plugin Developer Info page. Verify the installed version through the WordPress admin plugins screen after updating.

Workarounds

Deactivate and remove the Affiliate Reviews plugin until an update can be applied.
Restrict Contributor account creation and require administrator approval for new registrations.
Deploy a Content Security Policy (CSP) that blocks inline scripts on rendered site pages.
Enforce a WAF ruleset that filters HTML event handlers and script tags in block attribute payloads.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update affiliate-reviews
wp plugin get affiliate-reviews --field=version

# Optional: deactivate the plugin until patched
wp plugin deactivate affiliate-reviews