CVE-2025-1454 – The Ninja Pages WordPress plugin through versio... (How to Fix)

Q: What is the severity of CVE-2025-1454?

CVE-2025-1454 has a CVSS score of 5.4 (MEDIUM). The Ninja Pages WordPress plugin through version 1.4.2 contains a stored cross-site scripting (XSS) vulnerability in its settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite installations where unfiltered_html is restricted. The vulnerability affects WordPress sites using this plugin.

📋 TL;DR

The Ninja Pages WordPress plugin through version 1.4.2 contains a stored cross-site scripting (XSS) vulnerability in its settings. This allows authenticated administrators to inject malicious scripts that execute when other users view affected pages, even in WordPress multisite installations where unfiltered_html is restricted. The vulnerability affects WordPress sites using this plugin.

💻 Affected Systems

Products:

Ninja Pages WordPress Plugin

Versions: through 1.4.2

Operating Systems: All platforms running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires administrator-level access to exploit. Affects WordPress multisite installations even when unfiltered_html capability is disallowed.

📦 What is this software?

Ninja Pages by Ninja Pages Project

View all CVEs affecting Ninja Pages →

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires administrator privileges. The vulnerability is in plugin settings that aren't properly sanitized.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.4.3 or later

Vendor Advisory: https://wpscan.com/vulnerability/0089f813-82fa-4ffc-acd6-a70e67edc8ea/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Ninja Pages plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the Ninja Pages plugin until patched

wp plugin deactivate ninja-pages

Restrict Admin Access

all

Implement strict access controls and monitoring for administrator accounts

🧯 If You Can't Patch

Remove administrator access from untrusted users
Implement web application firewall (WAF) rules to block XSS payloads

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for Ninja Pages version 1.4.2 or earlier

Check Version:

wp plugin get ninja-pages --field=version

Verify Fix Applied:

Verify Ninja Pages plugin version is 1.4.3 or later in WordPress admin panel

📡 Detection & Monitoring

Log Indicators:

Unusual plugin setting modifications
Administrator account performing unexpected actions

Network Indicators:

JavaScript payloads in plugin settings requests

SIEM Query:

source="wordpress" AND (event="plugin_edit" OR event="option_update") AND plugin="ninja-pages"

📊 Metadata

CVE ID: CVE-2025-1454

CVSS v3 Score: 5.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.05% exploit probability (13.8th percentile)

Published: May 15, 2025

Last Updated: June 12, 2025

🔗 References

https://wpscan.com/vulnerability/0089f813-82fa-4ffc-acd6-a70e67edc8ea/ Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-1454, you might also want to check these: