Improper Neutralization of Input During Web Page Generation

CVE-2025-31431 is a reflected XSS bug in the WordPress wp-bookmarks plugin from conlabz GmbH, affecting all versions through 1.1. An unauthenticated attacker can craft a malicious request that reflects attacker-controlled input into a page; the payload only fires if a victim user loads the crafted URL or otherwise performs the required action in a browser session.

The vendor/CNA CVSS 7.1 HIGH is technically defensible from a pure CVSS standpoint, but it overstates enterprise urgency. The real-world chain has two big brakes: user interaction is mandatory and the plugin is tiny/removed/unpatched, with Wordfence showing only about 60 active installs and WordPress.org showing the plugin was closed on March 24, 2025 for a security issue. That makes this a cleanup-and-replace issue, not an all-hands patch fire.

Why this verdict

• Start at 7.1 HIGH: the CNA scored it as unauthenticated remote reflected XSS, which is fair in CVSS terms.
• Downward adjustment for attacker position: exploitation is remote and unauthenticated, but it requires victim browser interaction. That implies a phishing or lure stage that modern email security, browser controls, and user behavior often stop.
• Downward adjustment for reachability: the product is a removed niche plugin with about 60 active installs reported by Wordfence, so the exposed population is tiny relative to mainstream enterprise web software.
• Downward adjustment for blast radius: this is session/context abuse, not direct server-side RCE. Impact depends heavily on who clicks and what their WordPress role can do.
• Downward adjustment for threat evidence: no KEV listing, EPSS is low, and no strong public exploitation signal was found.

Why not higher?

There is no evidence of active exploitation, no KEV listing, and no sign this is being weaponized at scale. More importantly, the chain still hinges on a victim click and then on the victim having useful WordPress privileges, which is materially weaker than a pre-auth server-side bug.

Why not lower?

It is still unauthenticated remote input reaching script execution in a browser, and if an administrator clicks, the attacker may pivot into meaningful site actions. The plugin is also unpatched/removed, so affected installs do not have a clean vendor-upgrade path and need direct operator action.

1. Remove the plugin — If wp-bookmarks exists anywhere, remove it and replace the functionality with a maintained alternative. Because this verdict is MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; in practice, abandoned plugins should be eliminated far sooner during normal hygiene work.
2. Block risky plugin paths at the edge — If immediate removal is delayed, add temporary WAF or reverse-proxy rules for any known wp-bookmarks routes and suspicious reflected-input patterns. This is a stopgap only; for MEDIUM there is no mitigation SLA, but the control reduces opportunistic drive-by exploitation until the plugin is removed.
3. Hunt by filesystem and inventory — Search fleets for /wp-content/plugins/wp-bookmarks/ and correlate with external site ownership so you can identify the handful of real exposures fast. This is the highest-ROI move for a 10,000-host estate because internet scanning will not reliably find every abandoned plugin.
4. Protect admin sessions — Enforce MFA on WordPress admin accounts, limit administrator count, and prefer re-auth for sensitive actions where possible. These controls do not fix XSS, but they reduce the value of a compromised browser session while you clean out the plugin.

Run this on the target WordPress host or on a mounted backup of the webroot. Invoke it as bash check-wp-bookmarks-cve-2025-31431.sh /var/www/html with read access to the WordPress files; root is not required unless your webroot permissions are restrictive.

#!/usr/bin/env bash
# check-wp-bookmarks-cve-2025-31431.sh
# Purpose: Detect whether WordPress plugin wp-bookmarks is installed and vulnerable to CVE-2025-31431.
# Usage: bash check-wp-bookmarks-cve-2025-31431.sh /path/to/wordpress
# Exit codes:
#   0 = PATCHED (plugin absent or version > 1.1)
#   1 = VULNERABLE (plugin present and version <= 1.1)
#   2 = UNKNOWN (cannot determine)

set -u

WP_ROOT="${1:-}"
if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN: missing WordPress root path argument"
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/wp-content/plugins/wp-bookmarks"
MAIN_FILE=""
VERSION=""

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "PATCHED: wp-bookmarks plugin not present at $PLUGIN_DIR"
  exit 0
fi

# Try likely main plugin files first.
for f in "$PLUGIN_DIR/wp-bookmarks.php" "$PLUGIN_DIR/index.php"; do
  if [[ -f "$f" ]]; then
    MAIN_FILE="$f"
    break
  fi
done

# Fallback: search first-level PHP files for a plugin header or version string.
if [[ -z "$MAIN_FILE" ]]; then
  while IFS= read -r -d '' f; do
    if grep -qiE '^[[:space:]]*Version:[[:space:]]*[0-9]' "$f"; then
      MAIN_FILE="$f"
      break
    fi
  done < <(find "$PLUGIN_DIR" -maxdepth 1 -type f -name '*.php' -print0 2>/dev/null)
fi

# Try readme.txt first, then plugin main file.
if [[ -f "$PLUGIN_DIR/readme.txt" ]]; then
  VERSION=$(grep -iE '^(Stable tag|Version):' "$PLUGIN_DIR/readme.txt" | head -n1 | sed -E 's/^[^:]+:[[:space:]]*//' | tr -d '\r')
fi

if [[ -z "$VERSION" && -n "$MAIN_FILE" && -f "$MAIN_FILE" ]]; then
  VERSION=$(grep -iE '^[[:space:]]*Version:[[:space:]]*' "$MAIN_FILE" | head -n1 | sed -E 's/^[^:]+:[[:space:]]*//' | tr -d '\r')
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: wp-bookmarks directory exists but version could not be determined"
  exit 2
fi

# Normalize version string to first token.
VERSION=$(echo "$VERSION" | awk '{print $1}')

# Compare versions using sort -V.
lowest=$(printf '%s\n%s\n' "$VERSION" "1.1" | sort -V | head -n1)
if [[ "$lowest" == "$VERSION" && "$VERSION" != "1.1+" ]]; then
  # VERSION <= 1.1
  echo "VULNERABLE: wp-bookmarks version $VERSION detected at $PLUGIN_DIR"
  exit 1
fi

echo "PATCHED: wp-bookmarks version $VERSION is greater than 1.1"
exit 0

Sources

1. NVD CVE-2025-31431
2. Patchstack advisory
3. Wordfence vulnerability record
4. Wordfence plugin metadata
5. WordPress.org plugin page
6. OpenCVE record
7. CISA weekly vulnerability bulletin (week of 2025-03-31)
8. CISA Known Exploited Vulnerabilities Catalog