CVE-2025-9989: XSS in Broadstreet WordPress Plugin
Platform
wordpress
Component
broadstreet
Fixed in
1.53.2
CVE-2025-9989 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Broadstreet WordPress plugin. This vulnerability allows authenticated attackers, specifically those with administrator-level permissions, to inject arbitrary web scripts. The issue stems from insufficient input sanitization and output escaping within the plugin's admin settings, affecting versions 1.0.0 through 1.53.1. A patch is available in version 1.53.2.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2025-9989 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to a variety of malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data. Given that the vulnerability requires administrator privileges, the potential impact is significant, as an attacker could gain control over the entire WordPress installation. The vulnerability is specifically triggered in multi-site installations where the unfiltered_html option has been disabled, increasing the attack surface.
Exploitation Context
CVE-2025-9989 was published on 2026-05-13. Severity is currently assessed as Medium. No public exploits or active campaigns targeting this vulnerability have been reported as of this date. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- High — requires a race condition, non-default configuration, or specific circumstances. Harder to exploit reliably.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
Mitigation and Workarounds
The primary mitigation for CVE-2025-9989 is to immediately upgrade the Broadstreet WordPress plugin to version 1.53.2 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider temporarily disabling the plugin or restricting access to the affected admin settings. While a direct WAF rule is difficult to implement due to the nature of XSS, input validation on the server-side can help prevent malicious code from being stored in the database. Review and strengthen input sanitization practices within the WordPress environment.
How to fix
Update to version 1.53.2, or a newer patched version
Frequently asked questions
What is CVE-2025-9989 — XSS in Broadstreet WordPress Plugin?
CVE-2025-9989 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Broadstreet WordPress plugin versions 1.0.0–1.53.1, allowing admin users to inject malicious scripts.
Am I affected by CVE-2025-9989 in Broadstreet WordPress Plugin?
You are affected if your WordPress site uses the Broadstreet plugin and is running version 1.0.0 through 1.53.1, especially in multi-site setups with unfiltered_html disabled.
How do I fix CVE-2025-9989 in Broadstreet WordPress Plugin?
Upgrade the Broadstreet plugin to version 1.53.2 or later to resolve the vulnerability. Consider temporary disabling the plugin if immediate upgrade is not possible.
Is CVE-2025-9989 being actively exploited?
As of the current date, there are no reports of active exploitation campaigns targeting CVE-2025-9989, but vigilance is still advised.
Where can I find the official Broadstreet advisory for CVE-2025-9989?
Refer to the Broadstreet plugin's official website or WordPress plugin repository for the latest security advisory and update information.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...