CVE-2025-28875
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in the BP Email Assign Templates WordPress plugin allows attackers to inject malicious scripts that execute when other users view affected pages. The vulnerability affects all WordPress sites using this plugin from any version up to 1.6. Attackers could steal session cookies, redirect users, or perform actions on their behalf.
💻 Affected Systems
- BP Email Assign Templates WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over WordPress sites, install backdoors, deface websites, or redirect users to malicious sites.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies or credentials, potentially compromising user accounts and performing unauthorized actions.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution, preventing any impact.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity, but this requires some level of access to inject payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'BP Email Assign Templates'. 4. Click 'Update Now' if available. 5. If no update appears, download version 1.7+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate bp-email-assign-templates
Web Application Firewall (WAF)
allConfigure WAF to block XSS payload patterns
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Enable WordPress security plugins with XSS protection features
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for BP Email Assign Templates versionCheck Version:
wp plugin get bp-email-assign-templates --field=versionVerify Fix Applied:
Verify plugin version is 1.7 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to plugin endpoints
- JavaScript payloads in form submissions
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests containing script tags or JavaScript payloads to plugin URLs
SIEM Query:
source="wordpress.log" AND ("bp-email-assign" OR "shanebp") AND ("script" OR "javascript" OR "onload" OR "onerror")