EUVD-2025-18449
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
The Wise Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Wise Chat WordPress plugin versions up to 3.3.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the X-Forwarded-For header processing that allows unauthenticated attackers to inject malicious scripts without authentication or user interaction. When vulnerable pages are accessed by site visitors, the injected scripts execute in their browsers, potentially enabling credential theft, session hijacking, or malware distribution. This vulnerability has a CVSS score of 7.2 (High) and affects all publicly-facing WordPress installations running the affected plugin versions.
Technical ContextAI
The Wise Chat plugin for WordPress (CPE: wp:wise-chat) fails to properly sanitize the X-Forwarded-For HTTP header, a standard header used by load balancers and proxies to indicate the client's originating IP address. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), where user-controlled input from the X-Forwarded-For header is stored in the database and later rendered in HTML output without adequate escaping. The plugin processes this header—intended for IP logging or geolocation functionality—but fails to apply WordPress's standard escaping functions (such as esc_html(), wp_kses_post(), or sanitize_text_field()) during both input sanitization and output rendering. This allows attackers to inject arbitrary JavaScript that persists in the database and executes in the context of the affected WordPress site.
RemediationAI
IMMEDIATE ACTION REQUIRED: (1) Update the Wise Chat plugin to version 3.3.5 or later, which should contain fixes for X-Forwarded-For header sanitization and output escaping. Check the Wise Chat WordPress.org plugin page or vendor advisory for patched version availability. (2) If an immediate patch is unavailable, disable the Wise Chat plugin until a fix is released using wp-cli or the WordPress admin dashboard. (3) TEMPORARY MITIGATION (if plugin must remain active): Implement Web Application Firewall (WAF) rules to block requests with suspicious JavaScript patterns in the X-Forwarded-For header; sanitize or reject X-Forwarded-For headers at the reverse proxy/load balancer level if the header is not required for legitimate functionality. (4) INCIDENT RESPONSE: If the site has been live with vulnerable versions, audit server logs and database for indicators of stored XSS injection (search plugin chat/message tables for script tags, event handlers, or base64 encoding). Review user activity logs for suspicious admin account access or password changes. Scan the site with WordPress security plugins (Wordfence, Sucuri) to detect and remove any injected malicious content.
Share
External POC / Exploit Code
Leaving vuln.today