CVE-2025-60144 Overview
CVE-2025-60144 is a stored cross-site scripting (XSS) vulnerability in the lenix-scss-compiler WordPress plugin developed by yonifre. The flaw affects all plugin versions up to and including 1.2. Attackers with high-privilege access can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The weakness maps to [CWE-79], Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction and produces a scope change, extending the impact beyond the vulnerable component into the victim's browser session.
Critical Impact
Successful exploitation allows an authenticated attacker to store JavaScript in plugin-controlled output, hijack sessions, and pivot into WordPress administrator contexts.
Affected Products
- yonifre Lenix scss compiler (lenix-scss-compiler) plugin for WordPress
- All versions from initial release through 1.2
- WordPress sites with the plugin activated
Discovery Timeline
- 2025-09-26 - CVE-2025-60144 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60144
Vulnerability Analysis
The lenix-scss-compiler plugin fails to neutralize user-supplied input before rendering it in generated web pages. An authenticated attacker submits crafted input containing HTML or JavaScript through plugin fields that accept SCSS content or configuration values. The plugin stores the payload and later reflects it into the response without contextual output encoding.
Because the payload is persisted, it executes for every user who loads the affected page. The scope change indicator in the vulnerability metrics reflects that scripts run in the WordPress site origin rather than the plugin's isolated context. This enables cookie theft, forced administrative actions through CSRF-like flows, and defacement of rendered content.
Root Cause
The root cause is missing output encoding on data returned from privileged plugin interfaces. The plugin trusts input from authenticated administrative users and writes it directly into HTML sinks without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). Reference details are available in the Patchstack XSS Vulnerability Report.
Attack Vector
Exploitation requires an authenticated account with high privileges on the WordPress instance. The attacker submits a malicious payload through plugin settings or SCSS input fields. When another user, typically an administrator, browses a page that renders the stored content, the payload executes in their browser and inherits their session privileges.
Detection Methods for CVE-2025-60144
Indicators of Compromise
- Unexpected <script> tags, on* event attributes, or javascript: URIs stored in lenix-scss-compiler plugin options within the wp_options table
- Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin-rendered pages
- New or modified WordPress administrator accounts created from unexpected source IP addresses
Detection Strategies
- Audit plugin configuration records for HTML control characters and JavaScript keywords in stored SCSS or settings values
- Review WordPress access logs for POST requests to plugin administrative endpoints containing encoded script fragments
- Correlate authenticated session activity with anomalous DOM modifications reported by browser telemetry
Monitoring Recommendations
- Enable WordPress audit logging to track plugin option changes and privilege modifications
- Deploy a web application firewall with signatures for common stored XSS payloads targeting WordPress plugins
- Monitor for unauthorized changes to user roles, especially escalations to the administrator role
How to Mitigate CVE-2025-60144
Immediate Actions Required
- Deactivate and remove the lenix-scss-compiler plugin until a patched version is available
- Rotate all WordPress administrator passwords and invalidate active sessions
- Review the wp_options table and remove any injected script content from plugin entries
Patch Information
No fixed version has been published at the time of NVD disclosure. Versions through 1.2 remain affected. Track vendor updates through the Patchstack advisory and the WordPress plugin repository for release notes.
Workarounds
- Restrict administrative access to the WordPress instance using IP allowlists and multi-factor authentication
- Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources
- Limit the number of accounts holding high-privilege roles that can modify plugin settings
# Content Security Policy header example for WordPress via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
