CVE-2025-27004: Famous Grid Gallery Plugin XSS Vulnerability

CVE-2025-27004 Overview

CVE-2025-27004 is a reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Attackers can inject malicious scripts that execute in the victim's browser when the victim clicks a crafted link. The vulnerability affects all versions of the plugin from initial release through version 1.4. Successful exploitation requires user interaction and can lead to session hijacking, credential theft, or unauthorized actions in the WordPress environment.

Critical Impact
Reflected XSS enables attackers to execute arbitrary JavaScript in a victim's browser session, potentially compromising WordPress administrator accounts and leading to full site takeover.

Affected Products

LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin (famous_grid_image_and_video_gallery)
All versions from initial release through 1.4
WordPress sites with the plugin installed and activated

Discovery Timeline

2026-01-08 - CVE-2025-27004 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27004

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw classified under [CWE-79]. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back into HTTP responses. When a victim visits a specially crafted URL containing malicious JavaScript payloads, the browser renders the injected content as executable code within the WordPress site's origin.

Reflected XSS attacks require user interaction, typically delivered through phishing emails, malicious links, or embedded content on attacker-controlled sites. The scope change component indicates that the injected script can affect resources beyond the vulnerable component itself. This can escalate to session cookie theft, credential harvesting via fake login overlays, or arbitrary actions performed on behalf of authenticated administrators.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin accepts user-controlled parameters through HTTP GET or POST requests and embeds those values directly into the HTML response without applying context-appropriate output encoding. WordPress functions such as esc_html(), esc_attr(), or wp_kses() should be applied to any reflected input, but the vulnerable code paths in famous_grid_image_and_video_gallery omit this sanitization.

Attack Vector

An unauthenticated attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by the plugin. The attacker distributes this URL through phishing, social engineering, or malicious advertising. When an authenticated WordPress user, particularly an administrator, clicks the link, the injected script executes in their browser under the site's origin. The attacker can then exfiltrate session tokens, perform CSRF-style privileged actions, or pivot to a full site compromise.

The vulnerability mechanism is described in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-27004

Indicators of Compromise

Suspicious HTTP requests to plugin endpoints containing <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
Referer headers pointing to attacker-controlled domains preceding administrator sessions
Anomalous outbound requests from administrator browsers to unfamiliar external hosts shortly after clicking inbound links
Unexpected changes to WordPress user accounts, plugin settings, or new administrator creation events

Detection Strategies

Deploy web application firewall (WAF) rules to flag reflected XSS patterns targeting famous_grid_image_and_video_gallery parameters
Review WordPress access logs for GET requests containing script tags, event handlers, or encoded JavaScript payloads
Correlate administrator authentication events with preceding phishing indicators or unusual referers
Monitor for unauthorized plugin, theme, or user modifications following suspicious inbound traffic

Monitoring Recommendations

Enable verbose HTTP logging on the WordPress reverse proxy or WAF to capture full query strings
Implement Content Security Policy (CSP) headers and alert on CSP violation reports
Track administrator session activity for geolocation anomalies or concurrent sessions
Ingest WordPress and web server logs into a centralized SIEM for correlation and retention

How to Mitigate CVE-2025-27004

Immediate Actions Required

Identify all WordPress instances running the Famous - Responsive Image And Video Grid Gallery plugin at version 1.4 or earlier
Deactivate and remove the plugin if a patched version is not yet available from the vendor
Force logout of all administrator sessions and rotate credentials for privileged WordPress accounts
Deploy WAF rules to block requests containing common XSS payload patterns targeting the plugin

Patch Information

At the time of publication, no fixed version beyond 1.4 is confirmed in the enriched CVE data. Administrators should consult the Patchstack Vulnerability Report for the latest remediation status and monitor the LambertGroup vendor channel for a security release.

Workarounds

Disable the plugin until a vendor patch is released and validated in a staging environment
Restrict access to WordPress administrative interfaces using IP allowlisting or VPN-only access
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Train administrators to avoid clicking untrusted links while authenticated to WordPress

bash

# Example: WordPress plugin deactivation via WP-CLI
wp plugin deactivate famous_grid_image_and_video_gallery
wp plugin delete famous_grid_image_and_video_gallery

# Example: Nginx rule to block common reflected XSS payloads
if ($query_string ~* "(<|%3C)script(>|%3E)|javascript:|onerror=") {
    return 403;
}