CVE-2025-22804: Author Avatars List/Block XSS Vulnerability

CVE-2025-22804 Overview

CVE-2025-22804 is a stored Cross-Site Scripting (XSS) vulnerability in the Paul Bearne Author Avatars List/Block WordPress plugin. The flaw affects all plugin versions up to and including 2.1.23. Attackers with contributor-level access can inject malicious JavaScript that executes in the browsers of other users viewing the affected pages. The vulnerability is tracked under [CWE-79], Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject persistent JavaScript payloads that execute against administrators and site visitors, enabling session theft, account takeover, and further compromise of the WordPress site.

Affected Products

Paul Bearne Author Avatars List/Block plugin for WordPress
All versions from n/a through 2.1.23
WordPress installations that render the affected plugin's blocks or shortcodes

Discovery Timeline

2025-01-09 - CVE-2025-22804 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22804

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the Author Avatars List/Block plugin. Input passed to the block or shortcode attributes is rendered into the generated HTML without adequate sanitization or output encoding. As a result, an attacker with editing privileges can persist a JavaScript payload inside plugin-managed content.

When a victim loads a page containing the malicious payload, the browser parses and executes the attacker-controlled script in the context of the WordPress site's origin. Because the scope metric of the vulnerability is Changed, the injected script can affect resources beyond the vulnerable component itself. Typical outcomes include stealing authentication cookies, performing actions on behalf of administrators, and redirecting visitors to attacker infrastructure.

Root Cause

The plugin fails to apply WordPress sanitization primitives such as wp_kses_post(), esc_attr(), or esc_html() to values that are later reflected into HTML output. This missing output-encoding step allows raw HTML and <script> tags to survive into the rendered DOM.

Attack Vector

Exploitation requires an authenticated user with at least low privileges (for example, a contributor) and user interaction from the victim who loads the poisoned page. The attacker submits crafted attribute values through the block editor or a shortcode. Once the entry is stored, any subsequent page render triggers the payload in every viewer's browser.

No verified proof-of-concept code is published. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-22804

Indicators of Compromise

Presence of <script>, onerror=, onload=, or javascript: strings within plugin-managed post content or block attributes stored in the wp_posts and wp_postmeta tables
Unexpected outbound requests from browsers viewing pages that render the Author Avatars List/Block
New or modified administrator accounts created shortly after low-privileged users edited content

Detection Strategies

Review WordPress audit logs for content edits performed by contributor and author accounts on pages containing the Author Avatars block or [author_avatars] shortcode
Scan the WordPress database for HTML event handler attributes and inline script content stored inside plugin attributes
Inspect browser console errors and Content Security Policy (CSP) reports for blocked inline script executions

Monitoring Recommendations

Enable Content Security Policy reporting to surface inline script execution attempts on WordPress front-end pages
Monitor administrator session activity for unusual actions immediately after viewing pages that include user-generated avatar lists
Track plugin version inventory across all WordPress sites to identify installations still running Author Avatars List/Block 2.1.23 or earlier

How to Mitigate CVE-2025-22804

Immediate Actions Required

Update the Author Avatars List/Block plugin to a version released after 2.1.23 as soon as the vendor publishes a fix
Restrict contributor, author, and editor accounts to trusted users and enforce strong authentication
Audit existing posts and pages for injected script content in Author Avatars block instances and remove any malicious payloads

Patch Information

At the time of publication, the advisory lists all versions through 2.1.23 as affected and no fixed version is confirmed in the NVD entry. Consult the Patchstack advisory for the latest patch status and upgrade guidance.

Workarounds

Deactivate and remove the Author Avatars List/Block plugin until a patched release is available
Deploy a Web Application Firewall (WAF) rule that blocks HTML event handlers and <script> tags submitted through plugin endpoints
Apply a strict Content Security Policy that disallows inline scripts on WordPress front-end pages
Reduce the WordPress user role capabilities for unfiltered_html to administrators only

bash

# Disable the vulnerable plugin from the WordPress CLI
wp plugin deactivate author-avatars
wp plugin delete author-avatars

# Verify no residual plugin files remain
find wp-content/plugins -maxdepth 1 -name 'author-avatars*'