CVE-2025-26574: Google Drive WP Media XSS Vulnerability

CVE-2025-26574 Overview

CVE-2025-26574 is a stored Cross-Site Scripting (XSS) vulnerability in the Google Drive WP Media WordPress plugin developed by Moch Amir. The flaw affects all versions of the plugin up to and including 2.4.4. It stems from improper neutralization of user-supplied input during web page generation, tracked under CWE-79. An authenticated attacker with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. Successful exploitation requires user interaction and can lead to session compromise, content manipulation, or redirection to attacker-controlled resources.

Critical Impact

Authenticated attackers can inject persistent scripts that execute against site visitors and administrators, enabling session theft and unauthorized actions across a scope change boundary.

Affected Products

• Google Drive WP Media WordPress plugin versions up to and including 2.4.4
• WordPress sites that install and activate the google-drive-wp-media plugin
• Any user account interacting with pages rendering plugin-controlled content

Discovery Timeline

• 2025-02-13 - CVE-2025-26574 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26574

Vulnerability Analysis

The Google Drive WP Media plugin fails to sanitize or encode input before rendering it inside generated HTML output. This allows an attacker with authenticated access to store malicious payloads that persist server-side. When another user, including administrators, loads a page containing the injected content, the browser parses the payload as executable script. Because the vulnerability has a changed scope, the injected script can affect resources beyond the vulnerable component itself. This behavior is characteristic of stored XSS as classified under CWE-79.

Root Cause

The root cause is missing output encoding and input validation on plugin-controlled fields. The plugin trusts user-supplied data and writes it directly into the DOM without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows raw <script> tags and event handler attributes to reach the rendered response. The issue exists in code paths accessible to authenticated users with low privilege levels.

Attack Vector

Exploitation is performed over the network against a WordPress site running the vulnerable plugin. The attacker authenticates with a low-privilege account, then submits a crafted payload through an input field processed by the plugin. The payload is stored in the WordPress database. When a victim visits a page that renders the stored content, the script executes in the victim's browser session. The attack requires user interaction, satisfied by the victim navigating to the affected page.

No verified proof-of-concept code is publicly available. Refer to the Patchstack advisory for coordinated disclosure details.

Detection Methods for CVE-2025-26574

Indicators of Compromise

• Unexpected <script> tags, onerror, onload, or javascript: URIs stored in WordPress post metadata or plugin-specific database tables
• Outbound requests from administrator browser sessions to unfamiliar third-party domains shortly after loading plugin-rendered pages
• New or modified administrator accounts created without corresponding audit trail entries
• Anomalous plugin content submissions from low-privilege user accounts

Detection Strategies

• Review the WordPress database for the google-drive-wp-media plugin's stored fields and search for HTML or JavaScript syntax where plain text is expected
• Enable Content Security Policy (CSP) reporting to capture inline script violations originating from plugin-generated pages
• Correlate wp-admin activity logs with subsequent script execution events observed in browser telemetry

Monitoring Recommendations

• Monitor WordPress audit logs for content submissions containing HTML tags from non-administrator roles
• Alert on privilege escalation events, unexpected role changes, and new administrator account creation
• Track outbound HTTP requests from browsers accessing WordPress administrative interfaces

How to Mitigate CVE-2025-26574

Immediate Actions Required

• Identify all WordPress installations running the Google Drive WP Media plugin at version 2.4.4 or earlier
• Deactivate the plugin until a patched release is installed if administrative content pages cannot be isolated
• Audit stored plugin data for injected payloads and remove any malicious entries
• Rotate credentials for accounts that accessed affected pages during the exposure window

Patch Information

At the time of publication, the vendor advisory referenced by Patchstack tracks the vulnerability against versions through 2.4.4. Site administrators should upgrade to the latest available release of the google-drive-wp-media plugin and monitor the WordPress plugin repository for a fixed version.

Workarounds

• Restrict low-privilege account creation and enforce role-based access control on WordPress sites
• Deploy a Web Application Firewall (WAF) rule that filters <script> tags and event handler attributes submitted to plugin endpoints
• Enforce a strict Content Security Policy that blocks inline scripts on WordPress pages
• Remove the plugin entirely if it is not required for business operations

# Configuration example: enforce a restrictive CSP header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"