CVE-2025-24610

WordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Published Jan 24, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.

Analysis

Technical impact

The vulnerability is a stored cross‑site scripting flaw in the Restrict Anonymous Access plugin that allows malicious JavaScript to be embedded into pages rendered by WordPress. This can enable attackers to perform session hijacking, data theft, or defacement when site visitors or administrators view affected pages. The flaw is classified as CWE‑79 and the CVSS score of 6.5 indicates a moderate severity.

Affected Systems

The issue affects Christian Leuenberg’s Restrict Anonymous Access WordPress plugin versions 1.2 and earlier. Any WordPress installation with this plugin active is potentially vulnerable.

Risk and Exploitability

The EPSS score is below 1 % and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. The CVSS score reflects moderate potential impact. Based on the description, the likely attack vector is inferred to be an attacker submitting a malicious value through the plugin’s configuration or content entry interface, which would store the payload in the database and serve it to all users who load the affected page, thereby executing arbitrary JavaScript.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Christian Leuenberg

Restrict Anonymous Access

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.2

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Restrict Anonymous Access plugin to a newer version than 1.2 or uninstall it if no longer necessary.
If an upgrade is not available, disable the plugin to remove the malicious code path until a fix is released.
Inspect plugin‑related database entries for injected scripts and delete any that appear suspicious to remove existing malicious content.

Generated by OpenCVE AI on May 2, 2026 at 05:26 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-3814	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg, L.net Web Solutions Restrict Anonymous Access allows Stored XSS. This issue affects Restrict Anonymous Access: from n/a through 1.2.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.383% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/restrict-anonymous-access/vulnerability/wordpress-restrict-anonymous-access-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg, L.net Web Solutions Restrict Anonymous Access allows Stored XSS. This issue affects Restrict Anonymous Access: from n/a through 1.2.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.
References	https://patchstack.com/database/wordpress/plugin/restrict-anonymous-access/vulnerability/wordpress-restrict-anonymous-access-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/restrict-anonymous-access/vulnerability/wordpress-restrict-anonymous-access-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Jan 24, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 24, 2025 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg, L.net Web Solutions Restrict Anonymous Access allows Stored XSS. This issue affects Restrict Anonymous Access: from n/a through 1.2.
Title		WordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/restrict-anonymous-access/vulnerability/wordpress-restrict-anonymous-access-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`