CVE-2025-60184: SEO Search Permalink Stored XSS Vulnerability

CVE-2025-60184 Overview

CVE-2025-60184 is a stored cross-site scripting (XSS) vulnerability in the Terry L. SEO Search Permalink (seo-search-permalink) WordPress plugin. The flaw affects all versions up to and including 1.0.3. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with high privileges to persist malicious script content. When a victim loads the affected page, the injected payload executes in the victim's browser context. The vulnerability is tracked under CWE-79 and requires user interaction to trigger.

Critical Impact
An authenticated attacker can inject persistent JavaScript that executes in other users' browsers, enabling session theft, administrative action forgery, and pivot into the WordPress admin interface.

Affected Products

Terry L. SEO Search Permalink plugin for WordPress
All versions from n/a through 1.0.3
WordPress sites with the seo-search-permalink plugin enabled

Discovery Timeline

2025-09-26 - CVE-2025-60184 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60184

Vulnerability Analysis

The SEO Search Permalink plugin accepts input through its administrative interface and stores that input without adequate output encoding. When the stored data is later rendered in a WordPress page, the browser interprets attacker-controlled markup as executable script. This produces a stored XSS condition where a single injection persists across sessions and users.

The attack requires an authenticated user with elevated privileges to submit the malicious payload. It also requires a second user to load the affected view. Because the injected script runs within the WordPress origin, it inherits the victim's session cookies and CSRF tokens. The scope-changed impact reflected in the vector indicates the vulnerability can affect resources beyond the plugin's own boundary.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() when rendering stored configuration values. Server-side sanitization on write is also insufficient, so malicious markup survives storage and is served verbatim to browsers.

Attack Vector

An attacker with administrative or comparable elevated access authors a payload containing HTML or JavaScript and saves it through the plugin's settings or permalink configuration. The payload is written to the WordPress database. When any user visits a page that renders the stored value, the browser executes the payload in the site's origin. The attacker can steal authentication cookies, forge requests against the WordPress REST API, or modify page content shown to other administrators.

No verified public proof-of-concept code is available. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-60184

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in wp_options or plugin-specific tables tied to seo-search-permalink.
Administrative page renders that include markup not present in plugin templates or theme files.
Outbound browser requests from admin sessions to unfamiliar domains shortly after loading plugin-managed pages.

Detection Strategies

Audit database rows written by the seo-search-permalink plugin for HTML, script tags, or encoded payload markers such as <script> or %3Cscript%3E.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from stored plugin content.
Correlate WordPress audit logs of plugin setting changes with subsequent admin session anomalies.

Monitoring Recommendations

Monitor WordPress admin logins and privilege changes for accounts that recently edited plugin settings.
Alert on modifications to plugin configuration rows in the WordPress database outside of change windows.
Track browser telemetry, where available, for script errors and CSP violations on admin URLs.

How to Mitigate CVE-2025-60184

Immediate Actions Required

Deactivate the SEO Search Permalink plugin until a patched version is confirmed available from the vendor.
Review all stored plugin settings and remove any HTML or script markup from configuration values.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Restrict administrative access to the WordPress dashboard using IP allow-listing or multi-factor authentication.

Patch Information

No fixed version is identified in the advisory. The vulnerability affects all releases up to and including version 1.0.3. Monitor the Patchstack XSS Vulnerability Report and the plugin's WordPress.org listing for a vendor-released update.

Workarounds

Uninstall the seo-search-permalink plugin and replace it with an actively maintained alternative.
Deploy a web application firewall rule that blocks HTML and script characters in requests targeting the plugin's admin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages.
Limit accounts with manage_options or equivalent privileges to trusted personnel only.

bash

# Configuration example: disable the plugin via WP-CLI until a patch ships
wp plugin deactivate seo-search-permalink
wp plugin status seo-search-permalink

# Optional: remove the plugin entirely
wp plugin uninstall seo-search-permalink