CVE-2025-2484: Multi Video Box WordPress XSS Vulnerability

CVE-2025-2484 Overview

CVE-2025-2484 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Multi Video Box plugin for WordPress. The flaw exists in all versions up to and including 1.5.2. The plugin fails to sanitize input and escape output on the video_id and group_id parameters. Unauthenticated attackers can inject arbitrary JavaScript into vulnerable pages. Successful exploitation requires user interaction, typically clicking a crafted link. Execution occurs in the victim's browser session under the WordPress site's origin.

Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser to steal session tokens, hijack administrator accounts, or redirect users to malicious content.

Affected Products

Multi Video Box plugin for WordPress — all versions through 1.5.2
views/video/get_shortcode.php — vulnerable video_id handling
views/group/get_shortcode.php — vulnerable group_id handling

Discovery Timeline

2025-03-22 - CVE-2025-2484 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2484

Vulnerability Analysis

The Multi Video Box plugin processes the video_id and group_id request parameters within its shortcode rendering logic. The affected files, views/video/get_shortcode.php and views/group/get_shortcode.php, output these parameters directly into the response without applying WordPress sanitization functions such as sanitize_text_field() or output escaping helpers like esc_html() and esc_attr().

Because the reflected values reach the HTML response unencoded, an attacker can supply JavaScript payloads that the browser parses and executes. The vulnerability is classified as Reflected XSS because the injected script travels in the request URL and is echoed back in the immediate response. The EPSS score is 0.304%, reflecting current probability estimates for exploitation activity.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the shortcode view files. WordPress provides context-appropriate escaping APIs, but the plugin routes user-controlled parameters into rendered markup without invoking them. This violates the secure coding pattern recommended by the WordPress Plugin Handbook.

Attack Vector

Exploitation requires an unauthenticated attacker to craft a URL targeting a page that renders the vulnerable shortcode. The URL embeds a malicious payload in video_id or group_id. The attacker delivers the link through phishing email, social media, or a compromised third-party site. When a victim clicks the link, the payload executes in their browser under the WordPress site's origin. If the victim holds an authenticated session, the attacker can perform actions on their behalf, exfiltrate cookies, or pivot to administrative takeover.

No verified proof-of-concept code has been published. Technical details are available in the Wordfence Vulnerability Analysis and the WordPress Multi Video Box source code.

Detection Methods for CVE-2025-2484

Indicators of Compromise

Web server access logs containing video_id= or group_id= parameters with URL-encoded <script>, javascript:, onerror=, or onload= payloads.
Referrer headers from external phishing infrastructure pointing to pages that embed the Multi Video Box shortcode.
Unexpected outbound requests from authenticated WordPress user sessions to attacker-controlled domains shortly after clicking inbound links.

Detection Strategies

Deploy a Web Application Firewall (WAF) ruleset that inspects video_id and group_id query parameters for HTML metacharacters and JavaScript keywords.
Search WordPress request logs for anomalous request patterns containing encoded script tags, event handlers, or data: URIs targeting shortcode pages.
Monitor for administrator session cookies transmitted to external hosts through browser telemetry or endpoint network visibility.

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward logs to a centralized SIEM for correlation.
Alert on repeated malformed requests to URLs containing the Multi Video Box shortcode parameters from a single source.
Track newly created administrator accounts, plugin changes, or theme edits following suspicious inbound traffic patterns.

How to Mitigate CVE-2025-2484

Immediate Actions Required

Update the Multi Video Box plugin to a version later than 1.5.2 once the vendor publishes a fix. Monitor the plugin developer page for release updates.
Deactivate and remove the plugin if a patched release is not yet available and the shortcode is not business-critical.
Audit administrator and editor accounts for signs of compromise, including unexpected password resets or content changes.

Patch Information

At the time of the last NVD update on 2026-06-17, all versions of the Multi Video Box plugin up to and including 1.5.2 remain vulnerable. Consult the Wordfence advisory for the latest fix status. Apply vendor patches promptly once released and verify plugin integrity after upgrade.

Workarounds

Remove or disable pages that embed the Multi Video Box shortcode until a patched version is installed.
Deploy a WAF rule that blocks requests containing HTML tags or JavaScript event handlers in the video_id and group_id parameters.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Require administrators to authenticate through a separate browser profile to reduce the risk of session theft through XSS.

bash

# Example WAF rule (ModSecurity) blocking script payloads in vulnerable parameters
SecRule ARGS:video_id|ARGS:group_id "@rx (?i)(<script|javascript:|onerror=|onload=|<svg)" \
  "id:1002484,phase:2,deny,status:403,log,msg:'CVE-2025-2484 Multi Video Box XSS attempt'"