CVE-2025-24721: Easy YouTube Gallery Stored XSS Vulnerability

CVE-2025-24721 is a stored cross-site scripting vulnerability in the Easy YouTube Gallery WordPress plugin affecting versions up to 1.0.4. This flaw enables attackers to inject malicious scripts that execute in users' browsers. This post covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-24721 Overview

CVE-2025-24721 is a stored cross-site scripting (XSS) vulnerability in the Easy YouTube Gallery WordPress plugin by Aleksandar Urošević. The flaw affects all versions up to and including 1.0.4. It stems from improper neutralization of user-supplied input during web page generation, categorized as [CWE-79]. An authenticated attacker with low privileges can inject malicious scripts that persist in the site database. When other users view affected pages, the payload executes in their browsers within the site's origin.

Critical Impact
Stored XSS in the Easy YouTube Gallery plugin allows authenticated attackers to inject persistent JavaScript that executes in visitors' browsers, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

Aleksandar Urošević Easy YouTube Gallery WordPress plugin
All versions from n/a through 1.0.4
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-01-24 - CVE-2025-24721 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24721

Vulnerability Analysis

The vulnerability exists in the Easy YouTube Gallery plugin's input handling logic. The plugin fails to properly sanitize or escape user-supplied data before rendering it in the WordPress front-end or admin interface. This allows an attacker with contributor-level or higher privileges to submit gallery content containing HTML or JavaScript payloads. The payload is stored in the WordPress database and later reflected without proper output encoding.

Exploitation requires low privileges and user interaction, and the scope changes when the injected script executes. The stored nature means every visitor to the affected page becomes a target, amplifying impact across the site's user base.

Root Cause

The root cause is missing or insufficient input validation and output encoding in plugin functions that process gallery configuration values. WordPress provides functions such as sanitize_text_field(), wp_kses_post(), and esc_attr() for these purposes. The plugin does not consistently apply these functions to attacker-controllable fields before storage and rendering.

Attack Vector

An authenticated attacker submits a crafted payload through a plugin input field, such as a gallery title, description, or shortcode attribute. The malicious content is persisted to the database. When an administrator or site visitor loads a page that renders the injected content, the browser executes the attacker's JavaScript in the context of the WordPress site.

The vulnerability manifests in gallery rendering paths where stored values are echoed without escaping. See the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-24721

Indicators of Compromise

Unexpected <script>, <iframe>, or event handler attributes (onerror, onload) stored in WordPress wp_posts or wp_postmeta tables related to Easy YouTube Gallery entries
Outbound requests from visitor browsers to unfamiliar domains after loading gallery pages
New administrator accounts created without corresponding audit trail
Modifications to gallery shortcodes or configuration by low-privileged users

Detection Strategies

Query the WordPress database for gallery-related records containing HTML tags or JavaScript keywords such as javascript:, <script, or onerror=
Review web server access logs for POST requests to plugin endpoints from contributor or author accounts
Deploy a Web Application Firewall (WAF) rule to inspect gallery submission payloads for script content

Monitoring Recommendations

Monitor WordPress user role assignments and privilege escalations to detect follow-on activity
Log and alert on modifications to plugin data by non-administrator accounts
Track browser-side errors and Content Security Policy (CSP) violations that may indicate injected script execution

How to Mitigate CVE-2025-24721

Immediate Actions Required

Audit all Easy YouTube Gallery entries for suspicious HTML or JavaScript content and remove malicious payloads
Restrict contributor and author accounts on sites running the vulnerable plugin until a patched version is applied
Rotate credentials for administrator accounts that may have loaded compromised gallery pages
Deploy a virtual patch through a WAF to block XSS payloads targeting the plugin

Patch Information

At the time of publication, no fixed version beyond 1.0.4 is referenced in the advisory. Site operators should monitor the Patchstack XSS Vulnerability Advisory for patch availability and apply updates as soon as they are released.

Workarounds

Deactivate and remove the Easy YouTube Gallery plugin until a patched version is published
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources
Limit plugin editing capabilities to trusted administrators only using role management controls

bash

# Configuration example: enforce restrictive CSP header in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"