CVE-2025-12135: WPBookit WordPress Plugin XSS Vulnerability

CVE-2025-12135 Overview

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the css_code parameter in all versions up to, and including, 1.0.6. The vulnerability exists due to a missing capability check on the save_custome_code() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Critical Impact

Unauthenticated attackers can persistently inject malicious JavaScript into WordPress pages, potentially leading to session hijacking, credential theft, defacement, or further compromise of site administrators and visitors.

Affected Products

• WPBookit WordPress Plugin versions up to and including 1.0.6
• WordPress sites with WPBookit plugin installed
• Any user accessing pages containing injected malicious scripts

Discovery Timeline

• 2025-11-21 - CVE-2025-12135 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12135

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) allows unauthenticated attackers to inject malicious JavaScript code that persists in the WordPress database and executes when users visit affected pages. The vulnerability stems from the WPBookit plugin failing to implement proper authorization checks on the save_custome_code() function, which handles custom CSS code submissions.

The attack is network-accessible and requires no authentication or user interaction for the initial injection phase. However, the malicious payload activates when legitimate users browse to pages containing the injected content. The scope of this vulnerability extends beyond the vulnerable component, as injected scripts can access cookies, session tokens, and other sensitive information from the victim's browser context.

Root Cause

The root cause is a missing capability check on the save_custome_code() function within the WPBookit plugin. WordPress plugins should implement proper authorization using functions like current_user_can() to verify that users have appropriate permissions before processing sensitive operations. The vulnerable function accepts the css_code parameter without validating whether the request originates from an authenticated administrator, allowing any unauthenticated user to submit and store arbitrary code.

Additionally, the input sanitization for the css_code parameter is insufficient, failing to properly escape or filter JavaScript content embedded within CSS code blocks. The vulnerable code paths can be examined in the WordPress Route Handler Code, WordPress Routes Class Code, and WordPress Setting Controller Code.

Attack Vector

The attack is executed over the network without requiring authentication. An attacker can craft a malicious HTTP request to the WordPress AJAX handler or REST endpoint exposed by the WPBookit plugin, injecting JavaScript payloads within the css_code parameter. Since no capability check exists, the server processes and stores the malicious content in the database.

When any user—including site administrators—visits a page where WPBookit renders its content, the injected JavaScript executes in their browser context. This can lead to cookie theft, session hijacking, keylogging, phishing overlays, or redirects to malicious sites. Detailed technical analysis is available at Ryan Kozak's Analysis on CVE-2025-12135 and a proof-of-concept repository is available at GitHub PoC Repository.

Detection Methods for CVE-2025-12135

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in stored CSS content within the WordPress database
• Unusual HTTP POST requests to WPBookit plugin endpoints from unauthenticated sources
• User reports of unexpected browser behavior, redirects, or pop-ups on pages utilizing WPBookit functionality
• Database entries in WPBookit-related tables containing encoded or obfuscated script content

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing script tags or JavaScript event handlers in CSS-related parameters
• Monitor WordPress AJAX and REST API endpoints for suspicious unauthenticated requests targeting WPBookit plugin routes
• Deploy file integrity monitoring to detect unauthorized modifications to WPBookit plugin files
• Regularly audit database content for stored XSS payloads in plugin configuration tables

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to WordPress admin-ajax.php and REST API endpoints
• Configure alerts for anomalous patterns of unauthenticated POST requests to the site
• Implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS exploitation
• Monitor browser console errors and network traffic from site visitors for signs of script injection

How to Mitigate CVE-2025-12135

Immediate Actions Required

• Update WPBookit plugin to a version newer than 1.0.6 that includes the security fix
• Review database content for any injected malicious scripts and remove unauthorized entries
• Temporarily deactivate the WPBookit plugin if an update is not immediately available
• Audit site logs for evidence of exploitation attempts

Patch Information

A security patch has been released for the WPBookit plugin. The fix implements proper capability checks on the save_custome_code() function to ensure only authenticated administrators can modify custom CSS settings. The patch details can be reviewed in the WordPress Changeset History. Additional vulnerability details are available from the Wordfence Vulnerability Report.

Workarounds

• Implement WAF rules to block requests containing suspicious payloads in the css_code parameter
• Restrict access to WordPress AJAX endpoints at the web server level using IP allowlists
• Add custom capability checks via a must-use plugin to protect the vulnerable endpoint until the official patch is applied
• Deploy Content Security Policy headers to limit the execution of inline scripts

# Apache .htaccess workaround to block unauthenticated access to admin-ajax.php for WPBookit actions
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} admin-ajax\.php
    RewriteCond %{QUERY_STRING} action=wpbookit [NC,OR]
    RewriteCond %{REQUEST_BODY} action=wpbookit [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
    RewriteRule .* - [F,L]
</IfModule>