CVE-2025-7486 Overview
The Ebook Store plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Order Details functionality. The flaw affects all versions up to and including 5.8012. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts. Injected scripts execute when any user accesses the affected page. The issue applies only to WordPress multi-site installations and to installations where unfiltered_html has been disabled. The weakness is categorized as [CWE-79]: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated administrators on multi-site WordPress installations can store malicious JavaScript that executes in the browser context of any user visiting the injected Order Details page.
Affected Products
- Ebook Store plugin for WordPress — all versions through 5.8012
- WordPress multi-site installations running the vulnerable plugin
- WordPress installations where the unfiltered_html capability has been disabled
Discovery Timeline
- 2025-07-21 - CVE-2025-7486 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7486
Vulnerability Analysis
The Ebook Store plugin processes Order Details input without applying sufficient sanitization on write and without escaping on output. An authenticated administrator can submit payloads containing HTML or JavaScript into Order Details fields. The plugin stores the raw input and later renders it in the admin interface. When another user loads the affected page, the stored payload executes in that user's browser session.
The exploitation precondition narrows the attack surface. On single-site WordPress installations, administrators hold the unfiltered_html capability by default, which already permits arbitrary HTML and script injection through legitimate editing. The vulnerability becomes material on multi-site installations or where administrators have had unfiltered_html removed, since those administrators should not be able to inject scripts.
Successful exploitation can lead to session theft, forced administrative actions through CSRF chaining, or redirection to attacker-controlled infrastructure.
Root Cause
The root cause is missing input sanitization and missing output escaping on Order Details fields handled in the plugin's functions.php. The plugin does not apply WordPress sanitization helpers such as wp_kses_post() on input or esc_html() and esc_attr() on output. Review of the referenced WordPress Plugin Function Code shows the affected code path.
Attack Vector
The attack vector is network-based and requires high privileges. An attacker who has obtained administrator credentials on a vulnerable multi-site network submits a crafted payload into an Order Details field. The payload persists in the database. Any subsequent user who loads the Order Details page triggers the stored script within their authenticated session. No user interaction beyond page visit is required.
No code example is provided because no verified proof-of-concept is available. See the Wordfence Vulnerability Analysis for additional technical context.
Detection Methods for CVE-2025-7486
Indicators of Compromise
- Order Details records containing <script>, onerror=, onload=, or javascript: substrings in the WordPress database
- Unexpected outbound HTTP requests from administrator browser sessions to unfamiliar domains after viewing Order Details pages
- New or modified administrator accounts created shortly after Order Details pages were accessed
Detection Strategies
- Query the WordPress database for Ebook Store order records containing HTML tags or JavaScript event handlers
- Review web server access logs for POST requests to Ebook Store order endpoints submitted by administrator accounts
- Audit the installed version of the Ebook Store plugin against the fixed release referenced in WordPress Changeset #3328355
Monitoring Recommendations
- Enable WordPress audit logging to capture administrator activity on order management pages
- Deploy a web application firewall rule to flag script-like payloads in Ebook Store POST parameters
- Monitor for anomalous JavaScript execution and cookie exfiltration patterns originating from /wp-admin/ pages
How to Mitigate CVE-2025-7486
Immediate Actions Required
- Update the Ebook Store plugin to the version released in WordPress Changeset #3328355, which supersedes version 5.8012
- Audit existing Order Details records for stored script payloads and remove any malicious content
- Rotate credentials and session tokens for administrator accounts that may have viewed injected pages
Patch Information
The vendor addressed the issue in the commit tracked by WordPress Changeset #3328355. The patch adds proper input sanitization and output escaping to the Order Details handling in functions.php. Administrators should upgrade from any version at or below 5.8012 to the patched release.
Workarounds
- Deactivate the Ebook Store plugin on multi-site networks until the patched version is deployed
- Restrict administrator access on multi-site installations to a minimal set of trusted accounts
- Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers in Ebook Store order submission parameters
# Verify installed plugin version using WP-CLI
wp plugin get ebook-store --field=version
# Update the plugin to the latest patched release
wp plugin update ebook-store
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
