CVE-2025-58648: Simple JWT Login Stored XSS Vulnerability

CVE-2025-58648 Overview

CVE-2025-58648 is a stored Cross-Site Scripting (XSS) vulnerability in the Nicu Micle Simple JWT Login WordPress plugin. The flaw affects all versions from an unspecified starting release through and including version 3.6.4. The vulnerability arises from improper neutralization of user-supplied input during web page generation [CWE-79], allowing attackers with low-privileged access to inject persistent JavaScript payloads. Because the payload is stored, any user visiting the affected page executes the attacker's script in their browser context.

Critical Impact
An authenticated attacker with low privileges can store malicious scripts that execute in the browsers of other users, including administrators, enabling session theft, unauthorized actions, and pivoting to full site compromise.

Affected Products

Nicu Micle Simple JWT Login WordPress plugin
All versions up to and including 3.6.4
WordPress installations using the plugin for JWT-based authentication

Discovery Timeline

2025-09-22 - CVE CVE-2025-58648 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58648

Vulnerability Analysis

The Simple JWT Login plugin fails to properly sanitize and encode user-controlled input before rendering it in HTML output. This results in a stored XSS condition where attacker-supplied JavaScript persists in the database and executes whenever an authenticated user renders the affected view. Exploitation requires low privileges and user interaction, but the scope is changed because the injected script runs in the context of other users' sessions, including administrators. Successful exploitation can lead to session hijacking, forced administrative actions, and account takeover on the WordPress site.

Root Cause

The root cause is improper neutralization of input during web page generation, categorized as [CWE-79]. The plugin accepts input from an authenticated user and stores it without applying context-appropriate output encoding or sanitization filters such as esc_html(), esc_attr(), or wp_kses() when the value is later rendered. Consequently, HTML and JavaScript characters supplied by the attacker are interpreted by the browser instead of being displayed as literal text.

Attack Vector

The attack is delivered over the network and requires the attacker to hold a low-privileged account on the target WordPress site. The attacker submits a crafted payload containing JavaScript through an affected input field exposed by the plugin. The payload is stored server-side. When a victim, typically an administrator, loads the page that renders this stored value, the browser executes the attacker's script. The vulnerability manifests through standard HTTP requests, and technical details are available in the Patchstack WordPress Plugin Vulnerability advisory.

Detection Methods for CVE-2025-58648

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings stored in WordPress post metadata or plugin option tables associated with Simple JWT Login
Administrator sessions performing unexpected actions such as new user creation, role changes, or plugin installations shortly after viewing plugin-related pages
Outbound HTTP requests from admin browsers to unfamiliar domains after loading WordPress admin pages
Presence of Simple JWT Login plugin at version 3.6.4 or earlier in the WordPress plugin inventory

Detection Strategies

Query the wp_options, wp_postmeta, and wp_usermeta tables for HTML and JavaScript metacharacters in fields associated with the Simple JWT Login plugin
Deploy Web Application Firewall (WAF) rules that inspect POST parameters bound for Simple JWT Login endpoints for XSS payload patterns
Enable a Content Security Policy (CSP) in report-only mode to surface script executions from unexpected inline sources within /wp-admin/
Review WordPress activity logs for content modifications made by low-privileged accounts targeting plugin configuration

Monitoring Recommendations

Monitor WordPress admin traffic for anomalous JavaScript execution and unexpected DOM modifications via browser telemetry or endpoint agents
Alert on privilege changes, new administrator accounts, or plugin installations occurring outside change-control windows
Track plugin version inventory across managed WordPress sites and flag installations pinned to vulnerable Simple JWT Login releases

How to Mitigate CVE-2025-58648

Immediate Actions Required

Upgrade Simple JWT Login to a version later than 3.6.4 once released by the vendor
Audit existing plugin-related database entries for stored script payloads and remove any malicious content
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Restrict access to the WordPress admin interface using network-level controls until patched

Patch Information

At the time of NVD publication, the vulnerability affects Simple JWT Login versions through 3.6.4. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest fixed release and apply it across all environments.

Workarounds

Temporarily deactivate the Simple JWT Login plugin if a patched version is not yet available and JWT authentication is not business-critical
Restrict low-privileged account creation and require administrator approval for new subscribers or contributors
Deploy a WAF with rules blocking XSS payload signatures targeting the plugin's endpoints
Enforce a strict Content Security Policy on /wp-admin/ to block inline script execution from untrusted sources

bash

# Configuration example: temporarily deactivate the plugin via WP-CLI
wp plugin deactivate simple-jwt-login

# Verify installed plugin version
wp plugin get simple-jwt-login --field=version

# Update to the latest available version once released
wp plugin update simple-jwt-login