CVE-2025-27323: WP About Author DOM-Based XSS Vulnerability

CVE-2025-27323 Overview

CVE-2025-27323 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Jon Bishop WP About Author WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all versions of wp-about-author up to and including version 1.5.

An attacker can inject arbitrary JavaScript that executes in the browser context of a victim who interacts with a crafted link or page. Successful exploitation requires user interaction and low-privilege authentication, and can compromise session data, redirect users, or perform actions on behalf of the victim.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and unauthorized actions within the WordPress site.

Affected Products

Jon Bishop WP About Author plugin for WordPress
All versions from n/a through 1.5
WordPress sites with the wp-about-author plugin installed and active

Discovery Timeline

2025-02-24 - CVE-2025-27323 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27323

Vulnerability Analysis

The vulnerability is a DOM-based XSS issue in the WP About Author plugin. The plugin processes user-supplied input and inserts it into the Document Object Model (DOM) without proper sanitization or encoding. This allows attacker-controlled data to be interpreted as executable script by the browser.

Unlike reflected or stored XSS, DOM-based XSS executes entirely client-side. The malicious payload never needs to be reflected by the server, which complicates traditional server-side detection. The scope-changed impact indicates that a successful attack can affect resources beyond the vulnerable component itself.

Root Cause

The root cause is missing or insufficient output encoding in client-side JavaScript that handles user-influenced data. The plugin writes untrusted values into DOM sinks such as innerHTML, document.write, or similar interfaces without escaping HTML control characters. This allows script tags or event-handler attributes to be interpreted and executed.

Attack Vector

Exploitation requires an authenticated user with low privileges to trigger the vulnerable code path, along with victim interaction such as clicking a crafted link. The attack originates over the network and does not require high complexity. Once triggered, the injected script runs in the victim's browser under the origin of the WordPress site.

See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-27323

Indicators of Compromise

Unexpected <script> tags or on* event handler attributes appearing in rendered author profile pages
HTTP requests containing URL fragments or query parameters with encoded JavaScript payloads targeting wp-about-author endpoints
Outbound browser requests to unfamiliar domains originating from pages that use the plugin
Unusual session activity or administrative actions performed by low-privilege accounts

Detection Strategies

Inventory WordPress installations to identify sites running the wp-about-author plugin at version 1.5 or earlier
Review web server access logs for requests containing script-like payloads such as <script>, javascript:, or onerror=
Deploy Content Security Policy (CSP) reporting to capture blocked inline script execution attempts

Monitoring Recommendations

Monitor WordPress plugin directories for unauthorized modifications or unpatched vulnerable versions
Alert on anomalous authenticated user activity, particularly account changes following link clicks
Ingest WordPress and web server logs into a centralized analytics platform for correlation across sites

How to Mitigate CVE-2025-27323

Immediate Actions Required

Identify all WordPress sites running WP About Author version 1.5 or earlier
Deactivate and remove the plugin until a patched version is confirmed available
Audit user accounts and rotate credentials for any account that may have clicked a suspicious link
Review recent administrative actions for indicators of session hijacking

Patch Information

No vendor patch is referenced in the current advisory. Consult the Patchstack XSS Vulnerability Advisory for the latest status. Site operators should upgrade to a fixed release once published or migrate to an actively maintained alternative plugin.

Workarounds

Disable the wp-about-author plugin until a fix is released
Enforce a strict Content Security Policy that disallows inline scripts and untrusted origins
Deploy a Web Application Firewall (WAF) with rules that block common XSS payload patterns
Restrict low-privilege author accounts and require multi-factor authentication for all WordPress logins

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-about-author
wp plugin delete wp-about-author