CVE-2025-64220 Overview
CVE-2025-64220 is a stored cross-site scripting (XSS) vulnerability in the ReyCommerce Rey Core WordPress plugin. The flaw affects all versions of Rey Core up to and including 3.1.8. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of other users who view the affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account takeover when a privileged user renders attacker-controlled content.
Affected Products
- ReyCommerce Rey Core WordPress plugin
- All versions from initial release through 3.1.8
- WordPress sites running the Rey theme ecosystem that depends on Rey Core
Discovery Timeline
- 2025-10-29 - CVE-2025-64220 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64220
Vulnerability Analysis
The Rey Core plugin fails to properly neutralize user-supplied input before rendering it inside generated web pages. An authenticated user with contributor-level or similar low-privileged access can submit input containing HTML or JavaScript that the plugin stores and later serves without sufficient encoding or sanitization.
Because the payload is stored server-side, every subsequent visitor to the affected page triggers the injected script within the security context of the WordPress site. The scope change indicated in the vulnerability metadata reflects that code executed in a victim's browser can act beyond the vulnerable component, including issuing authenticated requests to the WordPress administrative interface.
Exploitation requires user interaction, meaning a victim (often an administrator) must visit the page containing the stored payload for execution to occur.
Root Cause
The root cause is missing output encoding and inadequate input sanitization in one or more Rey Core input handlers. The plugin accepts input intended for later rendering but does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before echoing the values into HTML context.
Attack Vector
The attack vector is network-based over standard HTTP or HTTPS requests to the WordPress site. An authenticated attacker submits a crafted payload containing script tags or event-handler attributes through a Rey Core input field. When another authenticated user, such as an editor or administrator, loads the page containing the stored value, the browser parses the payload as executable JavaScript. Attackers commonly abuse this to steal session cookies, perform actions on behalf of higher-privileged users, or pivot toward full administrator takeover.
See the Patchstack advisory for Rey Core XSS for additional technical detail.
Detection Methods for CVE-2025-64220
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or DOM event-handler attributes (onerror, onload, onmouseover) stored in Rey Core plugin database tables or wp_postmeta entries.
- Outbound requests from administrator sessions to unfamiliar domains shortly after loading pages rendered by Rey Core.
- New or modified WordPress administrator accounts created without a corresponding legitimate login event.
Detection Strategies
- Query the WordPress database for stored Rey Core content matching XSS signatures such as <script, onerror=, or javascript:.
- Review web server access logs for POST requests to Rey Core endpoints from low-privileged users followed by GET requests from administrators to the same resources.
- Enable and monitor a Content Security Policy (CSP) report endpoint to capture inline-script violations that indicate injected payloads executing in the browser.
Monitoring Recommendations
- Alert on modifications to WordPress user roles, especially privilege elevations to administrator.
- Monitor plugin file integrity and database changes to Rey Core options and postmeta tables.
- Track anomalous authenticated session activity, including cookie exfiltration patterns and unusual admin-ajax.php traffic.
How to Mitigate CVE-2025-64220
Immediate Actions Required
- Update the Rey Core plugin to a version released after 3.1.8 that addresses this vulnerability.
- Audit all users with contributor, author, or higher roles and remove accounts that are no longer required.
- Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Patch Information
At the time of publication, the vendor is expected to release a fixed version above 3.1.8. Consult the Patchstack advisory and the ReyCommerce vendor changelog for the specific patched release. Apply the update through the WordPress plugin manager or by replacing plugin files with the fixed distribution.
Workarounds
- Restrict access to Rey Core input fields by limiting the roles authorized to author or edit affected content until a patch is applied.
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing common XSS payload patterns directed at Rey Core endpoints.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Disable the plugin if it is not essential to site functionality until the update is installed.
# Example: enforce a restrictive CSP header via Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
