CVE-2025-58704: WP Delete User Accounts Stored XSS Flaw

CVE-2025-58704 Overview

CVE-2025-58704 is a stored Cross-Site Scripting (XSS) vulnerability in the Ren Ventura WP Delete User Accounts plugin for WordPress. The flaw affects all versions up to and including 1.2.4. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent JavaScript payloads. Execution requires user interaction, and the scope is changed, meaning injected scripts can affect resources beyond the vulnerable component. The weakness is tracked under CWE-79.

Critical Impact
Authenticated attackers can store malicious scripts that execute in the browsers of other site users, enabling session theft, administrative action hijacking, and defacement within the WordPress admin context.

Affected Products

Ren Ventura WP Delete User Accounts (wp-delete-user-accounts) WordPress plugin
All versions from n/a through 1.2.4
WordPress sites with the plugin installed and active

Discovery Timeline

2025-09-22 - CVE-2025-58704 published to the National Vulnerability Database
2026-10-11 - Last updated in NVD database

Technical Details for CVE-2025-58704

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WP Delete User Accounts plugin. The plugin accepts input that is later rendered in generated web pages without adequate output encoding or input sanitization. An authenticated user with low privileges can submit crafted payloads that persist in the application. When another user, typically an administrator, loads the affected page, the browser executes the attacker-controlled script in the site's origin context.

Because the attack produces a changed scope, the injected script can reach data and functionality beyond the vulnerable plugin. In WordPress deployments, this generally means access to administrative pages, cookies that are not flagged HttpOnly, nonces, and REST endpoints available to the victim's session. User interaction is required, which typically means visiting a page that renders the stored payload.

Root Cause

The root cause is improper neutralization of input during web page generation, as classified by CWE-79. The plugin does not apply WordPress sanitization helpers such as sanitize_text_field() on input or escaping helpers such as esc_html(), esc_attr(), or wp_kses_post() on output. As a result, HTML and JavaScript characters pass through unchanged and are interpreted by the browser when the stored content is rendered.

Attack Vector

The attack is remote and network-based. An authenticated low-privilege account submits a payload through an input vector exposed by the plugin. The payload is stored by the application. A second user then loads a page that renders the stored content, triggering execution. See the Patchstack XSS Vulnerability Advisory for additional technical context.

// No verified exploit code is published for CVE-2025-58704.
// Refer to the Patchstack advisory linked above for details.

Detection Methods for CVE-2025-58704

Indicators of Compromise

Unexpected <script>, <iframe>, onerror=, or onload= strings stored in plugin-related rows within the WordPress database.
New or modified administrator accounts, plugins, or theme files following access to pages rendered by wp-delete-user-accounts.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages.

Detection Strategies

Query wp_options, wp_usermeta, and plugin tables for HTML or JavaScript tokens associated with the plugin's input fields.
Review web server access logs for POST requests to plugin endpoints from low-privilege accounts followed by admin page views.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from WordPress pages.

Monitoring Recommendations

Monitor WordPress audit logs for user role changes, plugin installations, and option modifications after plugin usage.
Alert on anomalous session activity, including concurrent sessions and sudden privilege changes for administrator accounts.
Track plugin version inventory and flag any WordPress site still running wp-delete-user-accounts version 1.2.4 or earlier.

How to Mitigate CVE-2025-58704

Immediate Actions Required

Identify all WordPress sites running the WP Delete User Accounts plugin and inventory installed versions.
Deactivate and remove the plugin on any site where a patched release is not yet available.
Rotate administrator passwords and invalidate active sessions if suspicious stored content is found.

Patch Information

At the time of publication, versions up to and including 1.2.4 are affected and no fixed version is listed in the NVD entry. Monitor the Patchstack XSS Vulnerability Advisory and the plugin's WordPress.org page for a patched release and upgrade immediately when published.

Workarounds

Restrict the ability to register or hold low-privilege accounts on affected sites until a patch is deployed.
Place the WordPress admin interface behind a web application firewall (WAF) with XSS payload inspection enabled.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

bash

# Remove the vulnerable plugin via WP-CLI until a patched version is available
wp plugin deactivate wp-delete-user-accounts
wp plugin uninstall wp-delete-user-accounts