Urgent: What WordPress Site Owners Need to Know About the Broadstreet Ads Stored XSS (CVE‑2025‑9989) — And How to Protect Your Site

Last updated: 12 May 2026

As a Hong Kong-based security expert, I am issuing a concise technical advisory on a recently disclosed stored Cross‑Site Scripting (XSS) vulnerability affecting the Broadstreet Ads WordPress plugin (versions ≤ 1.53.1), tracked as CVE‑2025‑9989. The vendor released a patch in version 1.53.2.

Although exploitation requires an authenticated administrator to inject the payload, stored XSS in admin-editable content is high value to attackers: it can be used to steal credentials, create backdoors, and escalate from limited access to full site takeover. This advisory is defensive and action-oriented — if your site uses the Broadstreet Ads plugin, prioritise remediation.

Quick summary (TL;DR)

• A stored XSS vulnerability exists in Broadstreet Ads plugin versions ≤ 1.53.1 (CVE‑2025‑9989).
• The vulnerability requires an authenticated Administrator to submit malicious content that is later rendered without proper escaping.
• Patched version: 1.53.2. Update as soon as possible.
• If you cannot update immediately, temporary mitigations include: deactivate the plugin, restrict admin access, apply WAF-based virtual patching to block script-like payloads in admin POSTs, enforce strong access controls and 2FA, and monitor logs.

What exactly is the vulnerability?

This is a stored Cross‑Site Scripting (XSS) issue in the Broadstreet Ads plugin that allows an authenticated user with Administrator privileges to save crafted input (for example, in plugin settings or ad content). That input is later rendered in a context where the plugin fails to properly escape or sanitize it before output. When another admin views that page, the malicious script executes in their browser.

Key details:

• CVE: CVE‑2025‑9989
• Vulnerable plugin versions: ≤ 1.53.1
• Patched in: 1.53.2
• Required privilege to inject: Administrator (authenticated)
• Vulnerability type: Stored XSS — persistent script payloads execute in the browser of users who view the stored content

Why stored XSS in admin panels is dangerous even when the attack requires an admin account:

• Admin accounts can modify site configuration, install plugins/themes, create users, and interact with APIs. A successful stored XSS can be leveraged to:
• Steal authentication cookies or session tokens.
• Perform actions on behalf of the admin (create new admin users, modify code, install backdoors).
• Load secondary payloads that persist and affect additional high-privileged users.

Realistic attack scenarios

1. Malicious insider or social engineering: An attacker with access (or who obtains admin credentials) injects JavaScript into ad creative or settings. Another admin viewing those pages executes the payload.
2. Compromised third‑party admin account: Contractor or marketing admin accounts are common; compromise of one such account can be used to store malicious ad content.
3. Pivot from low‑privilege compromise to full takeover: Stored XSS can be used to load payloads that call update endpoints or contact attacker infrastructure to plant backdoors.
4. Targeted monetisation or reputation attacks: Persisting redirects, crypto‑miners, or malicious adverts can be injected to monetise the compromise or damage reputation.

How to check whether your site is affected (fast checks)

1. Check plugin version using WP Admin or WP‑CLI:

   wp plugin status broadstreet
   wp plugin list --status=active | grep broadstreet

   Or: Dashboard → Plugins → Installed Plugins → Broadstreet Ads — check the version.

2. If the plugin is ≤ 1.53.1, treat the site as vulnerable until patched.
3. Search for suspicious content in plugin settings or ad content fields. Example database queries:

   wp db query "SELECT ID, option_name FROM wp_options WHERE option_value LIKE '%

   Also inspect any custom Broadstreet tables.

4. Review admin activity and logs:
   • Check webserver and PHP logs for POSTs to /wp-admin/admin.php or plugin endpoints in the last 30 days.
   • Look for requests containing
5. Run an authenticated scan or trusted security audit to check for stored XSS in admin-editable fields.

• Block incoming POST data to Broadstreet admin endpoints that include: , onerror=, onload=, javascript:, data:text/html;, svg onload, innerHTML=, eval(, or Function(.
• Forbid requests with
• Create a response body filter that neutralises script tags emitted from the plugin before they reach client browsers (for example, replace |onerror\s*=|onload\s*=|javascript:|data:text/html|eval\(|Function\() Action: Block / Return 403

  And for responses:

  Condition: Response includes 'broadstreet' HTML OR Response Path matches plugin admin pages
  Replace: 
  			
  				
  			
  					
  
  							
  			
  			
  			
  
  
  
  
  
  		
  
  		
  					
  				 
   
     
   
    
   
   Review My Order
   0 
   
   
    
   
   
    
   
   
   
   Subtotal
   
  Taxes & shipping calculated at checkout
   
   
    
   
   
   
     Checkout