CVE-2025-25070: Album Reviewer XSS Vulnerability

CVE-2025-25070 Overview

CVE-2025-25070 is a stored cross-site scripting (XSS) vulnerability in the Album Reviewer WordPress plugin developed by ed atrero. The flaw affects all versions up to and including 2.0.2 and stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject malicious JavaScript that persists in plugin-generated pages and executes in the browsers of administrators or visitors who view the affected content. Exploitation requires user interaction but no authentication, and the resulting payload runs in a changed security scope, allowing session theft, privilege abuse, and content manipulation across the WordPress site.

Critical Impact
Unauthenticated attackers can store malicious scripts that execute in administrator browsers, enabling session hijacking and persistent site compromise.

Affected Products

ed atrero Album Reviewer plugin for WordPress
Album Reviewer versions through 2.0.2
WordPress sites using albumreviewer plugin

Discovery Timeline

2025-03-03 - CVE-2025-25070 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25070

Vulnerability Analysis

The Album Reviewer plugin fails to sanitize and encode user input before rendering it within plugin-generated HTML output. This stored XSS condition allows attackers to persist arbitrary JavaScript inside plugin data fields. When a victim, including site administrators, loads a page containing the injected payload, the script executes within the WordPress origin. The vulnerability has a scope change characteristic, meaning the impact reaches beyond the vulnerable component into the broader browser session. Attackers can leverage this to steal authentication cookies, perform actions on behalf of administrators, modify site content, or pivot to deliver further malware to visitors. EPSS data places this issue in the lower-mid exploitation likelihood band.

Root Cause

The plugin accepts input through review submission or configuration fields and writes it back into rendered pages without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). Output reflection without contextual encoding is the underlying defect.

Attack Vector

An attacker submits crafted input containing HTML or JavaScript through a plugin-exposed entry point. The input is stored in the WordPress database. When any user views the affected page, the unsanitized payload is delivered and executed by the browser. The attack requires victim interaction in the form of visiting a page but does not require attacker authentication.

The vulnerability mechanism is documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-25070

Indicators of Compromise

Unexpected <script>, onerror=, or onload= strings stored in wp_posts, wp_postmeta, or plugin-specific tables related to albumreviewer.
Outbound browser requests from administrator sessions to unfamiliar domains immediately after viewing album review pages.
New or modified WordPress administrator accounts created shortly after review content was submitted by anonymous users.

Detection Strategies

Audit plugin database tables for HTML tags, JavaScript event handlers, and encoded payloads such as <script>.
Monitor WordPress access logs for POST requests to Album Reviewer endpoints followed by GET requests from privileged users.
Deploy a Web Application Firewall (WAF) rule set that flags XSS payloads targeting plugin submission URLs.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations on pages that render plugin output.
Track integrity changes to WordPress administrator accounts, options, and active plugin lists.
Alert on anomalous session token reuse from new IP addresses after pages with plugin content are viewed.

How to Mitigate CVE-2025-25070

Immediate Actions Required

Disable or uninstall the Album Reviewer plugin until a patched release above 2.0.2 is confirmed available.
Review all stored album review content for embedded HTML or JavaScript and purge malicious entries.
Force a password reset and session invalidation for all WordPress administrator accounts.

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects Album Reviewer through 2.0.2. Site operators should monitor the Patchstack advisory for an updated release and apply it once published.

Workarounds

Restrict access to plugin submission endpoints using server-level authentication or IP allowlisting.
Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in requests to albumreviewer parameters.
Apply a strict Content Security Policy that disallows inline scripts to reduce the impact of stored payloads.

bash

# Example WAF rule (ModSecurity) blocking script tags on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/albumreviewer/" \
    "id:1002507,phase:2,deny,status:403,\
     msg:'Block XSS payload targeting Album Reviewer (CVE-2025-25070)',\
     chain"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" \
      "t:none,t:urlDecodeUni,t:htmlEntityDecode"