CVE-2020-37225: XSS in Powie's WHOIS Domain Check

An attacker exploiting this XSS vulnerability can inject malicious JavaScript code into the Powie's WHOIS Domain Check plugin's settings. Because the vulnerability requires authentication, the attacker needs valid credentials to access the plugin's configuration page (pwhois_settings.php). Successful exploitation allows the attacker to execute JavaScript in the context of the administrator user, potentially stealing session cookies, redirecting users to malicious websites, or modifying plugin settings. The impact is significant as it can lead to complete control over the WordPress site if the administrator's session is compromised. This vulnerability shares similarities with other XSS vulnerabilities where attackers leverage unsanitized input to inject malicious scripts.

1. Gereserveerd2026-05-13
2. Gepubliceerd2026-05-13

Since a patched version of Powie's WHOIS Domain Check is not yet available, immediate mitigation is crucial. The primary workaround is to restrict access to the pwhois_settings.php configuration page. Implement role-based access control within WordPress to limit which users can access this page. Consider using a Web Application Firewall (WAF) with XSS filtering rules to block suspicious requests targeting the plugin's settings. Regularly review and audit plugin settings for any unusual or unexpected changes. Monitor WordPress logs for any signs of attempted XSS exploitation, such as unusual JavaScript execution patterns. Verify access controls after implementing these mitigations by attempting to access the configuration page with a non-administrator user.