CVE-2025-25097: External Video For Everybody Stored XSS

CVE-2025-25097 Overview

CVE-2025-25097 is a stored Cross-Site Scripting (XSS) vulnerability in the External Video For Everybody WordPress plugin developed by kwiliarty. The flaw affects all plugin versions up to and including 2.1.1. Attackers with low privileges can inject persistent malicious scripts that execute in the browsers of users viewing affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Successful exploitation requires user interaction, but the impact crosses security scopes, affecting confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in visitor and administrator browsers, enabling session hijacking, credential theft, and further site compromise.

Affected Products

WordPress plugin: External Video For Everybody (external-video-for-everybody) by kwiliarty
All versions from n/a through <= 2.1.1
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2025-02-07 - CVE-2025-25097 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25097

Vulnerability Analysis

The vulnerability resides in how the External Video For Everybody plugin processes user-supplied input before rendering it in generated web pages. The plugin fails to properly neutralize input containing HTML or JavaScript payloads. Attackers with contributor-level or higher privileges can submit content containing script payloads that persist in the WordPress database. When a subsequent visitor or administrator loads a page containing the injected content, the browser executes the attacker-controlled script in the site's origin.

Stored XSS in WordPress plugins is a common vector for privilege escalation. An attacker who compromises a low-privileged account can inject payloads that steal session cookies from administrators or perform actions on their behalf.

Root Cause

The root cause is missing or insufficient output encoding and input sanitization within the plugin's video embedding logic. Content passed through plugin shortcodes or configuration fields is written to the page without being escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

Exploitation requires network access, low privileges, and user interaction. An authenticated attacker submits a crafted payload through a plugin input field or shortcode parameter. The payload is stored in the database and rendered without sanitization when other users view the affected page. Because the scope changes, the injected script can affect resources beyond the vulnerable component, including administrative sessions.

See the Patchstack WordPress Vulnerability Analysis for additional context on the injection points.

Detection Methods for CVE-2025-25097

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored in wp_posts, wp_postmeta, or plugin-specific options tables
Outbound HTTP requests from browser sessions to unfamiliar domains following visits to pages containing embedded videos
New or modified administrator accounts created shortly after content submissions from lower-privileged users
Anomalous cookie-bearing requests to /wp-admin/ originating from external IP addresses

Detection Strategies

Inventory WordPress installations and identify sites running external-video-for-everybody version 2.1.1 or earlier
Scan the WordPress database for suspicious HTML patterns within fields processed by the plugin
Review web server logs for POST requests to plugin endpoints containing encoded script payloads
Correlate content-authoring events by low-privileged users with subsequent administrator session anomalies

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts
Monitor WordPress audit logs for content edits made by contributor and author roles
Alert on administrative actions immediately following visits to pages containing user-submitted video embeds
Track browser telemetry for anomalous JavaScript execution originating from trusted WordPress origins

How to Mitigate CVE-2025-25097

Immediate Actions Required

Identify all WordPress instances running External Video For Everybody version 2.1.1 or earlier and prioritize remediation
Temporarily deactivate the plugin if a patched release is not yet installed in your environment
Audit recently created or modified posts containing plugin shortcodes for injected script content
Rotate administrator session cookies and reset credentials for accounts that may have viewed affected pages

Patch Information

At the time of this writing, refer to the Patchstack advisory for the latest fixed version and vendor guidance. Apply the vendor-provided update through the WordPress plugin manager as soon as it becomes available.

Workarounds

Restrict contributor, author, and editor roles to trusted users until the plugin is patched
Deploy a web application firewall (WAF) rule blocking script-like patterns in requests targeting plugin endpoints
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Remove the plugin entirely if it is not actively required for site functionality

bash

# Example WP-CLI commands to inventory and disable the vulnerable plugin
wp plugin list --name=external-video-for-everybody --fields=name,status,version
wp plugin deactivate external-video-for-everybody
wp plugin update external-video-for-everybody