CVE-2025-46227
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in the Custom Related Posts WordPress plugin allows attackers to inject malicious scripts into web pages. When users view pages containing the malicious content, the scripts execute in their browsers. This affects all WordPress sites using Custom Related Posts version 1.7.4 or earlier.
💻 Affected Systems
- Custom Related Posts WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, take over WordPress admin accounts, deface websites, or redirect users to malicious sites.
Likely Case
Attackers inject malicious JavaScript to steal user session cookies or credentials, potentially compromising user accounts.
If Mitigated
With proper input validation and output escaping, malicious scripts would be neutralized before reaching users.
🎯 Exploit Status
Exploitation requires contributor-level access or higher to inject malicious content. Public proof-of-concept details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.5 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Custom Related Posts' and click 'Update Now'. 4. Verify update to version 1.7.5 or later.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate custom-related-posts
Restrict User Roles
allLimit contributor and author access to reduce attack surface
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Enable Content Security Policy (CSP) headers to restrict script execution
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Custom Related Posts versionCheck Version:
wp plugin get custom-related-posts --field=versionVerify Fix Applied:
Verify plugin version is 1.7.5 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to plugin endpoints
- JavaScript payloads in form submissions
Network Indicators:
- Malicious script tags in HTTP requests to WordPress
SIEM Query:
source="wordpress" AND ("custom-related-posts" OR "crp") AND ("script" OR "javascript" OR "onload" OR "onerror")