CVE-2025-25168 Overview
CVE-2025-25168 is a Cross-Site Request Forgery (CSRF) vulnerability in the Black and White Digital BookPress – For Book Authors plugin for WordPress. The flaw affects all plugin versions up to and including 1.2.7. Attackers can chain the CSRF weakness with Stored Cross-Site Scripting (XSS) to inject malicious JavaScript that persists in the WordPress site. Exploitation requires an authenticated user to visit an attacker-controlled page. The issue is tracked under CWE-352 and referenced in the PatchStack Vulnerability Report.
Critical Impact
A successful CSRF-to-XSS chain lets attackers execute arbitrary JavaScript in the context of the victim's browser, enabling session theft, content manipulation, and administrative account takeover on affected WordPress sites.
Affected Products
- Black and White Digital BookPress – For Book Authors WordPress plugin
- All versions from initial release through 1.2.7
- WordPress sites with the book-press plugin installed and activated
Discovery Timeline
- 2025-02-07 - CVE-2025-25168 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-25168
Vulnerability Analysis
The BookPress plugin fails to validate the origin of state-changing HTTP requests. Requests that modify plugin data do not verify a WordPress nonce or equivalent anti-CSRF token. An attacker crafts a malicious web page containing a forged request targeting a plugin endpoint. When an authenticated site administrator or privileged user loads that page, the browser submits the request with valid session cookies.
The forged request writes attacker-controlled input into plugin fields that are later rendered without proper output encoding. This produces Stored XSS, meaning the injected payload persists in the database and executes for any user who views the affected page. The chained impact converts a passive social-engineering trigger into arbitrary script execution within the WordPress admin context.
Root Cause
The root cause is missing CSRF protection [CWE-352] on request handlers that accept user-supplied content. The plugin does not call wp_verify_nonce() or check check_admin_referer() before persisting data. A secondary defect is insufficient sanitization and escaping of stored input, allowing the CSRF entry point to escalate into a Stored XSS condition.
Attack Vector
Exploitation occurs over the network and requires user interaction. The attacker hosts an HTML page containing an auto-submitting form or a crafted image tag that issues a request to the vulnerable BookPress endpoint. A logged-in WordPress user with sufficient privileges must visit that page while their session is active. The scope is changed because the injected script runs in the victim site's origin, affecting other users who later view the poisoned content.
The vulnerability is exploitable without authentication material held by the attacker. See the PatchStack advisory for additional technical context.
Detection Methods for CVE-2025-25168
Indicators of Compromise
- Unexpected <script> tags, event handlers such as onerror= or onload=, or encoded JavaScript within BookPress plugin database tables and rendered pages.
- WordPress access logs showing POST requests to BookPress admin endpoints with a Referer header from an external domain.
- New or modified administrator accounts, unexpected plugin activations, or outbound requests to unknown domains from admin sessions.
Detection Strategies
- Review the WordPress wp_posts, wp_postmeta, and BookPress-specific tables for HTML or JavaScript content that should not be present in book metadata fields.
- Correlate authenticated admin sessions with anomalous POST requests missing the WordPress _wpnonce parameter.
- Deploy a Web Application Firewall (WAF) rule that flags cross-origin form submissions targeting /wp-admin/admin-post.php or /wp-admin/admin-ajax.php with BookPress action names.
Monitoring Recommendations
- Enable WordPress audit logging to record plugin option changes, post modifications, and user role updates.
- Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages rendered by BookPress.
- Alert on outbound HTTP requests from WordPress hosts to unknown domains, which may indicate exfiltration by injected XSS payloads.
How to Mitigate CVE-2025-25168
Immediate Actions Required
- Deactivate the BookPress plugin on all WordPress sites running version 1.2.7 or earlier until a patched release is confirmed installed.
- Audit administrator and editor accounts for unauthorized changes and reset credentials for any account that accessed the site during the exposure window.
- Inspect BookPress content and remove any injected <script> tags or HTML event handlers from stored records.
Patch Information
At the time of the NVD entry, the vendor advisory references BookPress versions through 1.2.7 as affected. Consult the PatchStack Vulnerability Report for the fixed version and apply the update through the WordPress plugin manager immediately upon availability.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist so that only trusted networks can submit authenticated requests.
- Deploy a WAF rule that enforces same-origin Referer and Origin header validation on BookPress admin endpoints.
- Require administrators to use a dedicated browser profile for WordPress management to reduce the chance of a CSRF trigger during normal browsing.
# Configuration example: temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate book-press --allow-root
wp plugin status book-press
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
