CVE-2025-60154: MWW Disclaimer Buttons Stored XSS Flaw

CVE-2025-60154 Overview

CVE-2025-60154 is a stored cross-site scripting (XSS) vulnerability in the MWW Disclaimer Buttons WordPress plugin developed by Jennifer Moss. The flaw affects all versions up to and including 3.41. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The vulnerability requires user interaction and can impact resources beyond the vulnerable component due to a scope change.

Critical Impact
Stored XSS enables persistent script execution against administrators and site visitors, allowing session theft, credential harvesting, and administrative action hijacking on WordPress sites running the affected plugin.

Affected Products

MWW Disclaimer Buttons WordPress plugin versions through 3.41
WordPress sites using the mww-disclaimer-buttons plugin by Jennifer Moss
All installations without a subsequent patched release applied

Discovery Timeline

2025-09-26 - CVE CVE-2025-60154 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60154

Vulnerability Analysis

The vulnerability resides in how the MWW Disclaimer Buttons plugin handles user-supplied input when rendering content into web pages. The plugin fails to properly sanitize or encode input before storing it and echoing it back into HTML output. This allows an attacker with sufficient privileges to inject arbitrary JavaScript that persists in the database.

Stored XSS differs from reflected variants because the malicious payload executes every time a victim loads the affected page. In WordPress environments, this pattern commonly targets administrator sessions, enabling secondary actions such as creating rogue admin accounts or exfiltrating nonces. The scope-changed impact indicates that the injected script can affect resources beyond the plugin's own security boundary, including the broader WordPress admin interface.

Root Cause

The root cause is missing or insufficient output encoding on user-controlled data rendered by the plugin. WordPress provides sanitization primitives such as esc_html(), esc_attr(), and wp_kses(), but the affected code paths in versions through 3.41 do not consistently apply them. Data written to plugin settings or button configuration fields is later reflected into HTML without neutralizing script-relevant characters.

Attack Vector

An authenticated attacker with high-privilege access submits crafted input containing HTML or JavaScript markup through the plugin's configuration interface. The payload is stored in the WordPress database. When another user (typically an administrator or site visitor) loads a page that renders the injected data, the browser executes the attacker's script in the context of the WordPress site. Exploitation requires user interaction to trigger the payload rendering.

The vulnerability mechanism is described in the Patchstack advisory for MWW Disclaimer Buttons. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2025-60154

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers (onerror, onload) stored in plugin option rows within wp_options or plugin-specific tables
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading WordPress admin pages
Newly created administrator accounts or modified user roles without a corresponding legitimate change record
Unexpected modifications to plugin settings by non-administrative users or during off-hours

Detection Strategies

Query the WordPress database for plugin option values containing <script, onerror=, or javascript: substrings
Review WordPress audit logs for changes to MWW Disclaimer Buttons configuration by high-privilege accounts
Inspect rendered HTML on pages that display disclaimer buttons for unauthorized inline scripts
Compare current plugin files against the official release to identify tampering

Monitoring Recommendations

Enable WordPress activity logging to capture plugin setting changes with user attribution
Deploy a web application firewall (WAF) with rules for common XSS payload patterns targeting admin endpoints
Monitor administrator sessions for anomalous API calls, especially user creation and role changes
Track browser telemetry from admin workstations for connections to unknown domains after WordPress logins

How to Mitigate CVE-2025-60154

Immediate Actions Required

Identify all WordPress sites running MWW Disclaimer Buttons and inventory versions in use
Restrict access to plugin configuration to a minimum set of trusted administrators
Audit stored plugin settings for existing script payloads and remove any suspicious content
Rotate administrator passwords and invalidate active sessions on affected sites

Patch Information

No fixed version is identified in the NVD entry at the time of publication. The advisory covers MWW Disclaimer Buttons versions through 3.41. Site operators should consult the Patchstack vulnerability record for updates and monitor the WordPress plugin repository for a patched release.

Workarounds

Deactivate and remove the MWW Disclaimer Buttons plugin until a patched version is published
Enforce two-factor authentication for all administrator accounts to raise the bar for the high-privilege prerequisite
Deploy a WAF ruleset that blocks XSS payloads submitted to wp-admin endpoints associated with the plugin
Apply a Content Security Policy (CSP) that disallows inline script execution on WordPress admin and public pages

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate mww-disclaimer-buttons
wp plugin delete mww-disclaimer-buttons

# Example CSP header (nginx) to limit inline script execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;