CVE-2025-15000 tfrommen CVE debrief

Who should care

Administrators of WordPress installations with the Page Keys plugin should assess their exposure and verify the plugin version. They should also review access controls and ensure that only authorized personnel have administrator-level access. This vulnerability requires verification from the supplied official sources to determine the exact scope of affected versions and potential impact.

Why it matters

CVE-2025-15000 is a Stored Cross-Site Scripting vulnerability in the Page Keys plugin for WordPress. It allows authenticated attackers with administrator-level access to inject arbitrary web scripts in pages, which execute when a user accesses the injected page. This affects multi-site installations and installations where unfiltered_html has been disabled. The CVE record and NVD entry provide details on the vulnerability, but the corpus does not establish versions beyond 1.3.3, exploitation, impact, or remediation beyond updating the plugin.

• Verify plugin version and update to a patched version if available
• Review access controls and ensure that only authorized personnel have administrator-level access
• Monitor for suspicious activity and implement compensating controls if necessary

Technical summary

The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3. This is due to insufficient input sanitization and output escaping. An attacker with administrator-level access could inject arbitrary web scripts in pages, which would execute when a user accesses the injected page. This vulnerability affects multi-site installations and installations where unfiltered_html has been disabled.

Defensive priority

Administrators of WordPress installations with the Page Keys plugin should verify the plugin version and update to a patched version if available. They should also review access controls and ensure that only authorized personnel have administrator-level access.

Recommended defensive actions

• Verify the Page Keys plugin version and update to a patched version if available
• Review access controls and ensure that only authorized personnel have administrator-level access
• Monitor for suspicious activity and implement compensating controls if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions beyond 1.3.3, exploitation, impact, or remediation beyond updating the plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.