CVE-2025-9333: Smart Docs WordPress Plugin XSS Vulnerability

CVE-2025-9333 Overview

CVE-2025-9333 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Smart Docs plugin for WordPress. The flaw affects all versions up to and including 1.1.1. The plugin fails to properly sanitize input and escape output within its admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who views an affected page. The vulnerability only impacts WordPress multi-site installations and installations where the unfiltered_html capability has been disabled.

Critical Impact
Authenticated administrators on multi-site WordPress installations can inject persistent JavaScript that executes against site visitors and super-administrators, enabling session theft and privilege escalation across the network.

Affected Products

Smart Docs plugin for WordPress, all versions through 1.1.1
WordPress multi-site installations with Smart Docs installed
WordPress single-site installations with Smart Docs where unfiltered_html is disabled

Discovery Timeline

2025-10-03 - CVE-2025-9333 published to the National Vulnerability Database (NVD)
2026-10-12 - Last updated in NVD database

Technical Details for CVE-2025-9333

Vulnerability Analysis

The Smart Docs plugin exposes administrative settings that accept user-supplied values. The plugin stores these values and later renders them into pages without applying WordPress sanitization helpers such as sanitize_text_field() or output escaping functions such as esc_html() and esc_attr(). An authenticated administrator can inject script payloads that persist in the database and execute whenever a user loads a page containing the injected content.

On standard single-site WordPress deployments, administrators already hold the unfiltered_html capability, which permits raw HTML and script content by design. The vulnerability therefore does not represent a privilege boundary violation in that configuration. On multi-site deployments, however, only super administrators retain unfiltered_html, so a site-level administrator who injects script content crosses a trust boundary.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the plugin's admin settings handlers. The plugin trusts administrator-supplied data and writes it to the page response without encoding HTML-significant characters.

Attack Vector

An attacker must first obtain administrator credentials on a target WordPress site that is either part of a multi-site network or has unfiltered_html explicitly disabled. The attacker then submits a payload containing JavaScript through the Smart Docs admin settings interface. The payload is stored and later executed in the browser context of any user who visits a page where the setting is rendered. Successful exploitation can lead to session hijacking, administrative action forgery, or further privilege escalation on multi-site networks.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-9333

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers (onerror, onload) stored in Smart Docs plugin option rows within the wp_options or site-level options tables.
Outbound requests from site visitors to attacker-controlled domains originating from pages that render Smart Docs settings.
New or modified administrator accounts created shortly after a Smart Docs settings change.

Detection Strategies

Audit the Smart Docs plugin configuration values stored in the database for HTML tags, URL-encoded script payloads, or JavaScript protocol handlers.
Review WordPress audit logs for update_option events tied to Smart Docs settings performed by non-super-admin accounts on multi-site deployments.
Scan rendered pages served by WordPress for inline scripts that do not match known theme or plugin templates.

Monitoring Recommendations

Enable a WordPress activity log plugin to capture administrator setting changes with before and after values.
Forward web server access logs to a centralized analytics platform and alert on anomalous referrer and query patterns against pages rendered by Smart Docs.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that should not contain scripts.

How to Mitigate CVE-2025-9333

Immediate Actions Required

Identify all WordPress sites running the Smart Docs plugin and confirm whether they are multi-site or have unfiltered_html disabled.
Deactivate the Smart Docs plugin on affected sites until a patched version is confirmed available.
Review and rotate credentials for any administrator accounts that may have been used to stage an exploit.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Site owners should monitor the Smart Docs plugin page on WordPress.org and the Wordfence advisory for updates and apply the fixed release as soon as it becomes available.

Workarounds

Restrict administrator access to trusted personnel and enforce multi-factor authentication for all WordPress administrator accounts.
On multi-site networks, limit which site administrators can install or configure the Smart Docs plugin by applying map_meta_cap filters.
Deploy a web application firewall rule to block requests to Smart Docs settings endpoints that contain <script>, onerror=, or javascript: payloads.
Enforce a strict Content Security Policy that disallows inline script execution across WordPress-rendered pages.

bash

# Disable the Smart Docs plugin network-wide using WP-CLI
wp plugin deactivate smart-docs --network

# Verify current plugin status
wp plugin status smart-docs