CVE-2025-27308: WP Video Posts XSS Vulnerability

CVE-2025-27308 Overview

CVE-2025-27308 is a reflected cross-site scripting (XSS) vulnerability in the WP Video Posts WordPress plugin developed by cmstactics. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all versions of wp-video-posts up to and including 3.5.1. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of a victim who clicks the link. Successful exploitation requires user interaction but no authentication, and the scope changes because the injected script executes in the security context of the WordPress site.

Critical Impact
Reflected XSS enables session hijacking, credential theft, and administrative action abuse when a logged-in WordPress administrator clicks a crafted link.

Affected Products

cmstactics WP Video Posts plugin for WordPress
All versions from n/a through 3.5.1
WordPress sites with wp-video-posts installed and active

Discovery Timeline

2025-04-17 - CVE-2025-27308 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27308

Vulnerability Analysis

The WP Video Posts plugin fails to sanitize or escape user-supplied input before reflecting it into HTTP responses. An attacker constructs a URL containing JavaScript payloads in request parameters processed by the plugin. When a victim loads the URL, the unsanitized input is rendered inside the HTML response, causing the browser to execute the attacker-controlled script. The CWE-79 classification confirms the root cause is improper neutralization of input during web page generation. The vulnerability scope is changed because script execution within the WordPress origin grants access to cookies, the DOM, and authenticated session state.

Root Cause

The plugin handlers accept request parameters and embed them directly into generated HTML without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). The absence of contextual output encoding allows attacker-supplied markup and script tags to break out of intended HTML contexts.

Attack Vector

Exploitation requires the attacker to deliver a crafted link to a target user through phishing, a malicious site, or a social media post. The attack vector is network-based with low complexity and no privileges required, but user interaction is mandatory. When the link is opened in an authenticated administrator's browser, the injected script can create new admin accounts, modify plugin settings, exfiltrate the wp_users table via REST API calls, or stage further attacks against the site. The EPSS score of 0.437% reflects current exploitation likelihood as tracked by FIRST.

No verified public exploit code is currently published. Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2025-27308

Indicators of Compromise

HTTP requests to wp-video-posts plugin endpoints containing <script>, javascript:, onerror=, or onload= substrings in query parameters
Web server access logs showing URL-encoded payloads such as %3Cscript%3E directed at plugin pages
Unexpected WordPress administrator accounts or modified user roles in wp_users and wp_usermeta tables
Outbound requests from administrator browsers to unfamiliar domains shortly after clicking external links

Detection Strategies

Inspect web server and WAF logs for reflected payloads in parameters processed by the wp-video-posts plugin
Enable WordPress audit logging to capture changes to user accounts, options, and plugin configuration
Deploy a Content Security Policy (CSP) in report-only mode and review violation reports for script-src breaches

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM for correlation against known XSS payload patterns
Alert on administrator session activity originating from new IP addresses or user agents immediately after email link clicks
Track plugin version inventory across WordPress estates to identify unpatched wp-video-posts installations

How to Mitigate CVE-2025-27308

Immediate Actions Required

Identify all WordPress sites running the wp-video-posts plugin at version 3.5.1 or earlier
Deactivate and remove the plugin if a vendor-patched release is not yet available
Rotate WordPress administrator passwords and invalidate active sessions after remediation
Review user accounts, scheduled tasks, and recently modified theme or plugin files for signs of compromise

Patch Information

At the time of publication, the Patchstack advisory lists affected versions through 3.5.1. Administrators should consult the WordPress plugin repository for the latest release and apply any vendor-supplied fix.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests containing common XSS payload signatures targeting wp-video-posts endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Restrict WordPress administrator access to known IP ranges using server-level controls or a plugin such as Limit Login Attempts
Train administrators to avoid clicking unsolicited links while authenticated to the WordPress admin panel

bash

# Example WAF rule (ModSecurity) to block reflected XSS payloads on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/wp-video-posts/" \
    "chain,deny,status:403,id:1002701,msg:'Blocked potential XSS in wp-video-posts'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"