CVE-2025-58823: Get Cash Plugin Stored XSS Vulnerability

CVE-2025-58823 Overview

CVE-2025-58823 is a stored Cross-Site Scripting (XSS) vulnerability in The African Boss Get Cash WordPress plugin. The flaw affects all versions of the get-cash plugin up to and including 3.2.3. The vulnerability stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].

Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing the affected pages. Successful exploitation requires user interaction and can lead to session hijacking, credential theft, or unauthorized actions performed in the victim's authenticated context.

Critical Impact
Stored XSS enables persistent script injection into WordPress pages, exposing administrators and site visitors to session theft and account takeover through crafted payloads served by the compromised site.

Affected Products

The African Boss Get Cash WordPress plugin (get-cash)
All versions from n/a through 3.2.3
WordPress sites with the plugin installed and active

Discovery Timeline

2025-09-05 - CVE-2025-58823 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58823

Vulnerability Analysis

The Get Cash plugin fails to properly sanitize and escape user-controlled input before rendering it into HTML output. An authenticated attacker submits crafted input containing JavaScript through an input vector exposed by the plugin. The plugin stores this input and later reflects it into rendered pages without adequate encoding.

When an authenticated user, including administrators, loads the affected page, the injected script executes in their browser session. The scope-changing nature of the flaw means the impact extends beyond the vulnerable component to other trusted origins in the browser context.

Exploitation requires an existing low-privileged account and interaction from a victim user. The persistent nature of stored XSS makes it more dangerous than reflected variants because payloads execute repeatedly against every visitor to the affected page.

Root Cause

The plugin does not apply appropriate output encoding functions such as esc_html(), esc_attr(), or wp_kses() when rendering stored user input. WordPress provides these sanitization APIs specifically to prevent [CWE-79] issues, but the plugin's input-handling paths bypass them.

Attack Vector

An authenticated attacker submits a payload containing HTML or JavaScript through a plugin field accessible to low-privileged users. The malicious content persists in the WordPress database. When any authenticated user visits a page rendering that stored content, the script executes in the browser under the site's origin, granting access to cookies, DOM state, and any actions the victim can perform.

See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-58823

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in plugin-managed database tables or post metadata
Outbound browser requests from administrator sessions to unfamiliar external domains after visiting plugin-generated pages
New or modified WordPress administrator accounts created shortly after low-privileged users interacted with the plugin
Unusual JavaScript resources loaded from Get Cash plugin pages

Detection Strategies

Review WordPress database contents managed by the get-cash plugin for encoded or raw HTML payloads containing script tags or event handlers
Deploy Web Application Firewall (WAF) rules that flag XSS payload patterns in POST requests to plugin endpoints
Correlate authenticated administrator page views with Content Security Policy (CSP) violation reports

Monitoring Recommendations

Enable WordPress audit logging to capture plugin data submissions and administrator actions
Monitor endpoint telemetry for browser processes spawning unexpected child processes after loading WordPress admin pages
Alert on modifications to wp_users and wp_usermeta tables outside of expected administrative workflows

How to Mitigate CVE-2025-58823

Immediate Actions Required

Deactivate the Get Cash plugin on all WordPress installations until a patched version is confirmed available
Audit all user-submitted content stored by the plugin and remove any entries containing HTML or JavaScript payloads
Rotate credentials for any administrator accounts that may have viewed affected pages
Review WordPress user roles and remove unnecessary low-privileged accounts that could serve as attack pathways

Patch Information

As of the CVE publication, all versions up to and including 3.2.3 are affected. Monitor the Patchstack advisory and the plugin repository for a fixed release, and apply it as soon as it becomes available.

Workarounds

Disable or uninstall the Get Cash plugin until a vendor-supplied patch is released
Deploy a Content Security Policy (CSP) that restricts inline scripts and limits allowed script sources
Place the WordPress admin interface behind a WAF with XSS filtering rules enabled
Restrict plugin-related permissions so only trusted, high-privileged accounts can submit content processed by the plugin

bash

# Deactivate the vulnerable plugin using WP-CLI
wp plugin deactivate get-cash
wp plugin uninstall get-cash

# Verify no remaining plugin data references remain
wp db query "SELECT * FROM wp_options WHERE option_name LIKE '%get_cash%';"