CVE-2025-9332: WordPress Human Anatomy Plugin XSS Vulnerability

CVE-2025-9332 Overview

CVE-2025-9332 is a Stored Cross-Site Scripting (XSS) vulnerability in the Interactive Human Anatomy with Clickable Body Parts plugin for WordPress. The flaw affects all versions up to and including 2.6. It stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts that execute when users access affected pages. The issue is scoped to multi-site installations and installations where unfiltered_html has been disabled.

Critical Impact
Authenticated administrators can inject persistent JavaScript into WordPress pages, enabling session theft, account takeover of higher-privileged users on multi-site networks, and content manipulation.

Affected Products

Interactive Human Anatomy with Clickable Body Parts plugin for WordPress (all versions ≤ 2.6)
WordPress multi-site installations running the affected plugin
WordPress installations where the unfiltered_html capability has been disabled

Discovery Timeline

2025-10-03 - CVE-2025-9332 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9332

Vulnerability Analysis

The vulnerability is a Stored XSS classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Attackers must hold administrator-level access to reach the vulnerable admin settings interface. Payloads are persisted in the plugin's configuration and rendered without proper escaping on front-end or back-end pages. The stored nature of the flaw means injected scripts execute for every visitor who loads an affected page.

In standard single-site WordPress installations, administrators already hold the unfiltered_html capability, which permits arbitrary HTML and JavaScript by design. The vulnerability therefore only produces a security boundary crossing on multi-site networks or configurations where unfiltered_html has been revoked. In those environments, a subordinate administrator can escalate influence to super administrators or other site users.

Root Cause

The plugin fails to sanitize user-supplied input submitted through admin settings and does not escape output when rendering stored values into pages. WordPress provides sanitization helpers such as sanitize_text_field() and escaping helpers such as esc_html(), esc_attr(), and wp_kses_post(). The plugin omits these controls on affected settings fields, allowing <script> tags and event-handler attributes to persist verbatim.

Attack Vector

Exploitation requires an authenticated session with administrator privileges. The attacker navigates to the plugin's settings screen, submits a payload containing JavaScript in a vulnerable field, and saves the configuration. When any user subsequently loads a page that renders the stored setting, the script executes in that user's browser context. On WordPress Multisite, a site administrator can target super administrators who visit the affected site.

No exploit code is required beyond a crafted HTML payload embedded in a settings field. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-9332

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: URIs stored in the plugin's option rows within the WordPress wp_options table.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading pages that render plugin content.
New or modified administrator accounts, changed user emails, or unauthorized privilege changes following administrator visits to affected pages.

Detection Strategies

Audit stored plugin settings for HTML control characters, script tags, and event-handler attributes using database queries against wp_options and site-specific options tables on Multisite.
Monitor WordPress audit logs for update_option events targeting the Interactive Human Anatomy plugin from administrator accounts.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

Correlate administrator login events with subsequent settings changes to identify anomalous configuration modifications.
Alert on browser-based indicators such as cookie exfiltration attempts or unexpected DOM modifications on WordPress admin pages.
Track plugin version inventory across all sites in a Multisite network and flag installations still running version 2.6 or earlier.

How to Mitigate CVE-2025-9332

Immediate Actions Required

Update the Interactive Human Anatomy with Clickable Body Parts plugin to a version newer than 2.6 as soon as the vendor publishes a patched release.
Review all administrator accounts on Multisite networks and revoke access for accounts that are not strictly required.
Inspect the plugin's stored settings and remove any embedded HTML or JavaScript introduced by untrusted administrators.

Patch Information

At the time of publication, review the WordPress Plugin Developer Resources page for the latest release notes and apply any available patched version. Confirm the fix status through the Wordfence Vulnerability Report before deploying.

Workarounds

Deactivate the Interactive Human Anatomy plugin on Multisite networks until a patched version is available.
Restore the unfiltered_html capability only for trusted super administrators and limit site-level administrator provisioning.
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin and front-end pages served by affected sites.

bash

# Example: audit plugin options for suspicious script content
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_name LIKE '%interactive_medical%' \
  AND (option_value LIKE '%<script%' OR option_value LIKE '%onerror=%');"

# Example: deactivate the plugin network-wide on Multisite
wp plugin deactivate interactive-medical-drawing-of-human-body --network