CVE-2025-58974 Overview
CVE-2025-58974 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the StellarWP WPComplete WordPress plugin. The flaw affects all versions of WPComplete up to and including 2.9.5.2. Attackers with low-privilege authenticated access can inject persistent malicious scripts into web pages generated by the plugin. When other users, including administrators, view the affected pages, the injected script executes in their browser session.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in the browsers of site visitors and administrators, leading to session theft, account takeover, or drive-by redirects.
Affected Products
- StellarWP WPComplete plugin for WordPress
- WPComplete versions from initial release through 2.9.5.2
- WordPress sites running the vulnerable plugin with contributor-level or higher accounts
Discovery Timeline
- 2025-09-22 - CVE-2025-58974 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58974
Vulnerability Analysis
The vulnerability stems from improper neutralization of user-supplied input during web page generation within the WPComplete plugin. The plugin fails to sanitize or escape input before storing it and rendering it back to users in HTML context. This allows attackers to persist arbitrary JavaScript in the WordPress database.
Exploitation requires an authenticated user with low privileges and involves user interaction to trigger the payload. The scope-changed nature of the flaw means injected scripts can affect components beyond the vulnerable plugin, including administrator sessions. Successful exploitation compromises the confidentiality, integrity, and availability of the WordPress instance.
Root Cause
The root cause is missing output encoding and input sanitization in the WPComplete plugin. Fields accepting user input are stored in the WordPress database without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). When the plugin renders these values into HTML pages, the browser interprets embedded script tags and event handlers as executable code.
Attack Vector
An authenticated attacker with contributor-level or higher access submits crafted input containing JavaScript payloads through a WPComplete plugin form or endpoint. The payload persists in the database. When an administrator or other user navigates to the affected page, the browser executes the stored script in the context of the WordPress site origin.
The attacker can steal session cookies, perform actions on behalf of the victim, deface the site, or redirect users to attacker-controlled infrastructure. See the Patchstack XSS Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-58974
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or on* event handlers stored in wp_postmeta or WPComplete-specific database tables
- WordPress admin sessions issuing unexpected REST or admin-ajax requests after viewing WPComplete content
- Outbound browser connections from administrator workstations to unfamiliar domains after loading plugin pages
Detection Strategies
- Audit WordPress database entries related to WPComplete for HTML or JavaScript content in fields expected to hold plain text
- Inspect web server access logs for POST requests to WPComplete endpoints containing encoded script payloads such as %3Cscript%3E
- Deploy a web application firewall rule to identify inbound requests containing common XSS signatures targeting WordPress plugin endpoints
Monitoring Recommendations
- Monitor WordPress user account creation and privilege escalation events, particularly for contributor and author roles
- Track plugin version inventory across WordPress deployments to identify hosts running WPComplete 2.9.5.2 or earlier
- Alert on administrator browser sessions generating anomalous DOM behavior or unexpected script execution when viewing plugin-rendered pages
How to Mitigate CVE-2025-58974
Immediate Actions Required
- Identify all WordPress instances running the StellarWP WPComplete plugin and confirm installed versions
- Restrict contributor and author account creation until a patched version is deployed
- Review existing WPComplete-managed content for previously injected script payloads and purge malicious entries
Patch Information
At the time of publication, the vulnerability affects WPComplete through version 2.9.5.2. Administrators should consult the Patchstack advisory and the StellarWP vendor channels for the current patched release and upgrade guidance.
Workarounds
- Deactivate and remove the WPComplete plugin until a fixed version is available
- Apply web application firewall rules that filter XSS payloads targeting the plugin's input parameters
- Enforce a strict Content Security Policy that disallows inline script execution on WordPress admin and front-end pages
- Limit plugin access to trusted administrator accounts and disable low-privilege roles that are not required
# Example: disable the WPComplete plugin via WP-CLI
wp plugin deactivate wpcomplete
wp plugin delete wpcomplete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
