Author: Dmitrii I

The Newsletter plugin for WordPress, with over 300,000 active installations, is widely adopted for managing subscriptions, creating automated campaigns, and personalizing subscriber experiences. However, a severe security flaw—CVE-2025-3584—has been discovered in the plugin’s subscription settings, specifically in its “Welcome page content” feature. This vulnerability allows users with Editor privileges to inject malicious JavaScript into the global “Welcome page” template. When unsuspecting visitors or administrators land on any post or page displaying the Welcome content, the injected script executes, opening the door to full account takeover via a persistent backdoor.

Ninja Forms is a leading WordPress plugin enabling site owners to build advanced forms without coding, with over 700,000 active installations. Despite its popularity and feature richness, a critical vulnerability—CVE-2025-2560—was discovered, allowing users with Editor-level privileges to inject persistent JavaScript into form configurations. This stored XSS can escalate to a full account takeover backdoor, jeopardizing the security of any site using Ninja Forms.

Ninja Forms is one of the most widely used WordPress plugins for creating contact forms with over 700,000 active installations. Its user-friendly drag-and-drop interface makes it a favorite among both developers and non-technical users. However, in the process of a routine plugin security audit, we discovered a critical vulnerability that permits Stored Cross-Site Scripting (XSS), allowing a contributor or editor to inject malicious JavaScript and potentially establish a persistent backdoor, leading to complete account takeover.

WordPress plugins play a vital role in extending the platform’s capabilities, yet they are frequently a weak point in site security. One such case is the Kali Forms plugin, a drag-and-drop form builder currently active on over 30,000 installations. A critical vulnerability, now assigned CVE-2025-3201, was discovered in the plugin that permits users with only Contributor-level privileges to inject and store malicious JavaScript. This XSS payload can be used to hijack administrator sessions, ultimately leading to the creation of rogue admin accounts and full site compromise.

The WordPress ecosystem is vast, with thousands of plugins extending its core functionality. However, the flexibility of these plugins can come at the cost of security if developers don’t adhere to strict input sanitization and output escaping practices. One such vulnerability was discovered in the popular Newsletter plugin, which is installed on over 300,000 websites. The issue, now identified as CVE-2025-3583, allows for Stored Cross-Site Scripting (XSS) that can be weaponized into a JavaScript backdoor, enabling attackers to hijack administrator accounts and compromise the entire site.

In the modern WordPress ecosystem, the principle of least privilege is critical for maintaining site security. It ensures that users can only perform actions strictly necessary for their roles. However, when plugins break this fundamental principle, even seemingly harmless user roles such as “Contributor” can exploit the system and execute powerful administrative actions. This is precisely the case with CVE-2025-3471—a Broken Access Control vulnerability discovered in the SureForms plugin.

SureForms is a powerful and widely adopted WordPress plugin used for creating customizable forms. With over 200,000 active installations, it is trusted by site administrators for building contact, feedback, and survey forms with ease. However, during a recent plugin assessment, a critical vulnerability was uncovered — a Stored Cross-Site Scripting (XSS) flaw — which allows malicious JavaScript injection through form field attributes. This vulnerability can be exploited by an editor to trigger a JavaScript backdoor, potentially leading to full administrative compromise.

SureForms is a widely used WordPress plugin for creating custom forms with a drag-and-drop interface. With over 200,000 active installations, it powers contact forms, feedback tools, and opt-in flows on thousands of websites. During a recent security audit, a critical vulnerability — Stored Cross-Site Scripting (XSS) — was identified. This flaw enables a user with editor-level privileges to inject persistent JavaScript into the form confirmation message. When exploited, this vulnerability can lead to JavaScript backdoor creation and full admin account takeover.

The WP Maps plugin is a popular solution for adding interactive maps to WordPress sites, boasting over 80,000 installations. However, during a security assessment, a severe vulnerability was discovered — a Stored Cross-Site Scripting (XSS) flaw that can be leveraged by an attacker with editor privileges to inject persistent JavaScript code. This code is later executed in the context of an administrator, potentially resulting in full site takeover.

The WP Maps plugin for WordPress, with over 80,000 active installations, provides an easy interface for users to create interactive maps on their websites. However, in the course of a routine security assessment, a serious vulnerability was identified — CVE-2025-3503. This vulnerability allows users with editor-level access or higher to inject persistent JavaScript code (Stored XSS) into map content, opening the door to the creation of a backdoor and full account compromise.