CVE-2025-9989: XSS in Broadstreet WordPress Plugin
Plataforma
wordpress
Componente
broadstreet
Corregido en
1.53.2
CVE-2025-9989 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Broadstreet WordPress plugin. This vulnerability allows authenticated attackers, specifically those with administrator-level permissions, to inject arbitrary web scripts. The issue stems from insufficient input sanitization and output escaping within the plugin's admin settings, affecting versions 1.0.0 through 1.53.1. A patch is available in version 1.53.2.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Impacto y Escenarios de Ataquetraduciendo…
Successful exploitation of CVE-2025-9989 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can lead to a variety of malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive user data. Given that the vulnerability requires administrator privileges, the potential impact is significant, as an attacker could gain control over the entire WordPress installation. The vulnerability is specifically triggered in multi-site installations where the unfiltered_html option has been disabled, increasing the attack surface.
Contexto de Explotacióntraduciendo…
CVE-2025-9989 was published on 2026-05-13. Severity is currently assessed as Medium. No public exploits or active campaigns targeting this vulnerability have been reported as of this date. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Inteligencia de Amenazas
Estado del Exploit
Vector CVSS
¿Qué significan estas métricas?
- Attack Vector
- Red — explotable remotamente por internet. Sin acceso físico ni local. Mayor superficie de ataque.
- Attack Complexity
- Alta — requiere condición de carrera, configuración no predeterminada o circunstancias específicas. Más difícil de explotar.
- Privileges Required
- Alto — se requiere cuenta de administrador o privilegiada.
- User Interaction
- Ninguna — el ataque es automático y silencioso. La víctima no hace nada.
- Scope
- Cambiado — el ataque puede pivotar a otros sistemas más allá del componente vulnerable.
- Confidentiality
- Bajo — acceso parcial o indirecto a algunos datos.
- Integrity
- Bajo — el atacante puede modificar algunos datos con alcance limitado.
- Availability
- Ninguno — sin impacto en disponibilidad.
Software Afectado
Clasificación de Debilidad (CWE)
Cronología
- Publicada
Mitigación y Workaroundstraduciendo…
The primary mitigation for CVE-2025-9989 is to immediately upgrade the Broadstreet WordPress plugin to version 1.53.2 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider temporarily disabling the plugin or restricting access to the affected admin settings. While a direct WAF rule is difficult to implement due to the nature of XSS, input validation on the server-side can help prevent malicious code from being stored in the database. Review and strengthen input sanitization practices within the WordPress environment.
Cómo corregirlo
Actualizar a la versión 1.53.2, o una versión parcheada más reciente
Preguntas frecuentestraduciendo…
What is CVE-2025-9989 — XSS in Broadstreet WordPress Plugin?
CVE-2025-9989 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Broadstreet WordPress plugin versions 1.0.0–1.53.1, allowing admin users to inject malicious scripts.
Am I affected by CVE-2025-9989 in Broadstreet WordPress Plugin?
You are affected if your WordPress site uses the Broadstreet plugin and is running version 1.0.0 through 1.53.1, especially in multi-site setups with unfiltered_html disabled.
How do I fix CVE-2025-9989 in Broadstreet WordPress Plugin?
Upgrade the Broadstreet plugin to version 1.53.2 or later to resolve the vulnerability. Consider temporary disabling the plugin if immediate upgrade is not possible.
Is CVE-2025-9989 being actively exploited?
As of the current date, there are no reports of active exploitation campaigns targeting CVE-2025-9989, but vigilance is still advised.
Where can I find the official Broadstreet advisory for CVE-2025-9989?
Refer to the Broadstreet plugin's official website or WordPress plugin repository for the latest security advisory and update information.
¿Tu proyecto está afectado?
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Detecta esta CVE en tu proyecto
Sube tu archivo de dependencias y detecta esta y otras CVEs al instante.
Escanea tu proyecto WordPress ahora — sin cuenta
Sube cualquier manifiesto (composer.lock, package-lock.json, lista de plugins WordPress…) o pega tu lista de componentes. Recibís un reporte de vulnerabilidades al instante. Subir un archivo es solo el primer paso: con una cuenta tenés monitoreo continuo, alertas en tu canal, multi-proyecto y reportes white-label.
Arrastra y suelta tu archivo de dependencias
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...