CVE-2025-6719 Overview
CVE-2025-6719 is a Stored Cross-Site Scripting (XSS) vulnerability in the Terms descriptions plugin for WordPress. The flaw affects all plugin versions up to and including 3.4.8. The vulnerability stems from insufficient input sanitization and output escaping within the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages. The issue is limited to WordPress multi-site installations and installations where the unfiltered_html capability has been disabled. The vulnerability is tracked under CWE-79.
Critical Impact
Authenticated administrators on multi-site WordPress deployments can store malicious JavaScript that executes in the context of any user visiting the injected page.
Affected Products
- WordPress Terms descriptions plugin versions ≤ 3.4.8
- WordPress multi-site installations running the affected plugin
- WordPress installations where unfiltered_html capability is disabled
Discovery Timeline
- 2025-07-18 - CVE-2025-6719 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6719
Vulnerability Analysis
The Terms descriptions plugin fails to properly sanitize input and escape output within its admin settings interface. An authenticated attacker with administrator privileges can submit crafted payloads that are stored in the plugin configuration. When any user later renders a page containing that stored content, the browser executes the attacker's script in the context of the WordPress site.
Stored XSS enables session theft, administrative action forgery, and distribution of further payloads to site visitors. Because exploitation requires administrator-level access, the practical risk arises in environments where administrative capabilities are segmented, such as WordPress multi-site networks. In those environments, site administrators are intentionally restricted from inserting raw HTML through the unfiltered_html capability, and this plugin flaw bypasses that control.
Root Cause
The plugin processes administrator-supplied values from its settings forms without applying WordPress sanitization helpers such as sanitize_text_field() or wp_kses() on input, and without escaping functions such as esc_html() or esc_attr() on output. Script tags and event handlers persist in the database and reach the browser unmodified.
Attack Vector
An attacker authenticated as a site administrator on a multi-site network submits malicious HTML or JavaScript through the plugin's admin configuration fields. The payload is stored persistently. When a target user—another administrator, editor, or visitor depending on where the content renders—loads the affected page, the script executes with the privileges of that user's session. Technical details are available in the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-6719
Indicators of Compromise
- Presence of <script> tags, javascript: URIs, or event handler attributes (onerror, onload) in Terms descriptions plugin settings stored in wp_options or site-specific option tables
- Unexpected outbound requests from browsers loading pages that reference the plugin's rendered content
- New or modified administrator accounts following access to affected pages
Detection Strategies
- Audit the WordPress options table for stored values originating from the Terms descriptions plugin and inspect for HTML or script content
- Review web server access logs for POST requests to wp-admin/options.php or plugin-specific admin endpoints containing script payloads
- Enable Content Security Policy (CSP) reporting to surface unexpected inline script execution on pages that render plugin output
Monitoring Recommendations
- Monitor administrator account activity on multi-site networks, especially changes to plugin settings
- Alert on modifications to the Terms descriptions plugin configuration across sub-sites
- Track browser-side errors and CSP violations reported from authenticated admin sessions
How to Mitigate CVE-2025-6719
Immediate Actions Required
- Update the Terms descriptions plugin to a version later than 3.4.8 once a patched release is available from the plugin page
- Review stored plugin settings for existing malicious payloads and remove any script content
- Audit administrator accounts on multi-site networks and remove unused or untrusted accounts
Patch Information
Consult the plugin listing at WordPress.org and the Wordfence Vulnerability Report for current patch status. Apply the fixed version across all sites in multi-site deployments.
Workarounds
- Deactivate the Terms descriptions plugin until a patched version is installed
- Restrict administrator access on multi-site networks to a minimum set of trusted users
- Deploy a Content Security Policy that blocks inline script execution on pages rendering plugin output
- Apply a web application firewall rule that strips script tags from POST requests targeting the plugin's settings endpoints
# Configuration example: deactivate the plugin via WP-CLI across a multi-site network
wp plugin deactivate terms-descriptions --network
# Verify no residual script payloads remain in site options
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_value LIKE '%<script%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
