Urgent: wp-mpdf <= 3.9.1 XSS (CVE-2025-60040) — What Site Owners Need to Know and Do Now

Author: Hong Kong Security Expert
Date: 2025-09-26

Overview

A Cross-Site Scripting (XSS) vulnerability was disclosed for the WordPress plugin wp-mpdf affecting versions ≤ 3.9.1 (CVE-2025-60040). The issue is fixed in version 3.9.2. Site owners and administrators should treat XSS issues seriously — even lower-severity XSS can be chained into more impactful attacks such as session theft, administrative account takeover via CSRF+XSS, content injection, or phishing.

This article is written from the perspective of Hong Kong security practitioners: it explains the exposure, assesses the risk, describes detection techniques, provides practical virtual-patching/WAF guidance you can apply immediately, and outlines step-by-step mitigation and clean-up if you suspect compromise. It assumes familiarity with WordPress administration and basic security operations.

What was reported (short summary)

• A Cross-Site Scripting (XSS) vulnerability exists in wp-mpdf versions up to and including 3.9.1.
• The vulnerability is tracked as CVE-2025-60040.
• The plugin author released a fixed version: 3.9.2. Site owners should update as soon as possible.
• The vulnerability allows injection of arbitrary script/HTML payloads in certain plugin inputs or outputs, enabling execution in the context of site visitors or authenticated users (reports indicate contributor-level privilege may be sufficient to exploit some flows).
• The public disclosure categorized the issue as Low priority (CVSS 6.5), but “Low” does not mean “ignore” — targeted or chained attacks remain possible.

Who is affected?

• Any WordPress site running the wp-mpdf plugin at version 3.9.1 or earlier.
• Attack surface depends on how the plugin is used and which user roles interact with its functionality. Contributor-level access has been reported as sufficient in some flows.
• Sites that expose plugin functionality to untrusted users (frontend forms, contributor workflows, shared editorial environments) are at higher risk.

Immediate risk assessment

Impact type: Cross-Site Scripting — client-side code execution.

Typical impacts include:

• Persistent (stored) XSS: malicious script stored and executed for other visitors.
• Reflected XSS: attacker entices a user to open a crafted URL or submit a payload; script executes in victim browser.
• Privilege escalation chains: with access to contributor/editor accounts it’s possible to inject scripts that perform privileged actions inside the admin UI.

Although public ratings list this as lower priority, sites that accept HTML from untrusted users can be heavily impacted. Attackers scan quickly; patching or applying virtual patches at the edge should be prioritised.

What to do right now (quick action checklist — follow this first)

1. Backup your site now (files + database).
2. Update wp-mpdf to version 3.9.2 (or remove the plugin if it is not needed).
3. If you cannot update immediately, apply virtual patching/WAF rules (examples below) to block known exploit patterns.
4. Review user accounts (look for unexpected contributors or editors) and reset passwords as needed.
5. Scan the site for indicators of compromise (malicious posts, modified theme/plugin files, unknown admin users, suspicious scheduled tasks).
6. Enable logging/alerting at the web server / WAF / application level to catch attempted exploit patterns.
7. If you manage multiple sites, push the update or virtual patching across your fleet.

How to update safely

From the WordPress admin:

• Plugins → Installed Plugins → find wp-mpdf → click “Update now”.

If you prefer the command line:

wp plugin update wp-mpdf

After updating, clear page caches and CDN caches to ensure visitors receive the corrected code.

Virtual patching and WAF guidance (apply immediately if you cannot update)

Virtual patching with a Web Application Firewall (WAF) mitigates attacks by blocking exploit attempts at the edge. Use the examples below as templates but tune them to your site’s normal traffic to avoid false positives. Test rules in monitoring mode first.

General approach:

• Scope rules to plugin endpoints and known parameter names.
• Block requests containing suspicious script markers in parameters used by the plugin.
• Block common XSS payload patterns like
  Review My Order

  0

  Subtotal

  Taxes & shipping calculated at checkout

  Checkout