CVE-2025-23799 Overview
CVE-2025-23799 is a reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the .TUBE Video Curator WordPress plugin developed by tubegtld. The flaw affects all versions of the tube-video-curator plugin from initial release through version 1.1.9. The vulnerability stems from improper neutralization of user-supplied input during web page generation. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when the link is clicked. Successful exploitation allows session hijacking, credential theft, and unauthorized actions performed on behalf of the targeted WordPress user.
Critical Impact
Reflected XSS enables attackers to execute arbitrary JavaScript in administrator browsers, potentially leading to session theft and full site compromise.
Affected Products
- tubegtld .TUBE Video Curator WordPress plugin versions through 1.1.9
- WordPress sites running the tube-video-curator plugin
- All deployments where the plugin processes unsanitized request parameters
Discovery Timeline
- 2025-02-03 - CVE-2025-23799 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23799
Vulnerability Analysis
The vulnerability is a reflected XSS issue in the .TUBE Video Curator plugin for WordPress. The plugin fails to properly sanitize and encode user-controlled input before reflecting it back into HTTP response pages. An attacker crafts a URL containing JavaScript payloads in vulnerable request parameters. When a victim clicks the link, the unsanitized input renders as executable script within the WordPress page context.
The attack requires user interaction, but no authentication is needed. Because the scope is changed, code executes with access to the victim's authenticated session, including administrator privileges. This enables theft of authentication cookies, modification of plugin settings, creation of rogue administrator accounts, and pivoting to further site compromise.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin reflects request parameters into HTML output without applying contextual output encoding or input validation. Standard WordPress sanitization functions such as esc_html(), esc_attr(), and wp_kses() are either missing or applied incorrectly in the affected code paths.
Attack Vector
The vulnerability is exploited over the network through crafted HTTP requests. An attacker constructs a URL targeting the vulnerable plugin endpoint with a malicious JavaScript payload embedded in a reflected parameter. The attacker delivers the URL through phishing emails, malicious advertisements, forum posts, or other social engineering channels. When an authenticated WordPress user — particularly an administrator — clicks the link, the embedded script executes in the browser under the site's origin.
No verified public proof-of-concept code is currently available. Refer to the Patchstack Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-23799
Indicators of Compromise
- HTTP request logs containing <script>, javascript:, onerror=, or onload= patterns in query string parameters targeting tube-video-curator plugin endpoints
- Unexpected administrator account creation or modification events in WordPress audit logs
- Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after clicking external links
- Modified WordPress plugin settings or unauthorized content changes performed by privileged users
Detection Strategies
- Deploy a web application firewall (WAF) with rules that flag reflected XSS payloads in URL parameters reaching the /wp-content/plugins/tube-video-curator/ path
- Inspect web server access logs for URL-encoded JavaScript syntax such as %3Cscript%3E targeting plugin endpoints
- Monitor WordPress activity logs for privileged actions occurring immediately after administrator URL clicks from external sources
Monitoring Recommendations
- Enable detailed HTTP request logging on WordPress sites and forward logs to a SIEM for query parameter analysis
- Configure alerts on WordPress core hooks that detect changes to user roles, plugin settings, or theme files
- Implement Content Security Policy (CSP) reporting endpoints to capture in-browser script execution attempts
How to Mitigate CVE-2025-23799
Immediate Actions Required
- Identify all WordPress installations running the .TUBE Video Curator plugin and inventory plugin versions
- Update the tube-video-curator plugin to a version newer than 1.1.9 once the vendor publishes a patched release
- If no patched version is available, deactivate and remove the plugin from production WordPress sites
- Force administrator password resets and invalidate active sessions if exploitation is suspected
Patch Information
The vulnerability affects all versions of the .TUBE Video Curator plugin through 1.1.9. Administrators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release that addresses CVE-2025-23799.
Workarounds
- Deactivate the tube-video-curator plugin until a patched version is released
- Deploy a WAF with rules blocking common XSS payload patterns in HTTP requests to plugin endpoints
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Train WordPress administrators to avoid clicking unsolicited links and to use separate browser profiles for site administration
# Disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate tube-video-curator
wp plugin delete tube-video-curator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
