CVE-2025-27325: Video.js HLS Player DOM-Based XSS Vulnerability

CVE-2025-27325 Overview

CVE-2025-27325 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Bruce Video.js HLS Player plugin (videojs-hls-player) for WordPress. The flaw affects all versions up to and including 1.0.2. It results from improper neutralization of input during web page generation, categorized under [CWE-79]. An attacker with low privileges can inject script content that executes in a victim's browser when the victim interacts with a crafted page. The vulnerability requires user interaction and impacts confidentiality, integrity, and availability at a limited scope.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in the browsers of authenticated WordPress users, enabling session theft, account takeover, and unauthorized actions within the WordPress site context.

Affected Products

Bruce Video.js HLS Player (videojs-hls-player) WordPress plugin, versions through 1.0.2
WordPress sites using the plugin for HLS video playback
Browsers rendering pages that load the vulnerable player component

Discovery Timeline

2025-02-24 - CVE-2025-27325 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27325

Vulnerability Analysis

The vulnerability is a DOM-Based Cross-Site Scripting flaw in the Video.js HLS Player plugin. Client-side JavaScript in the plugin writes attacker-influenced input into the Document Object Model (DOM) without adequate sanitization or encoding. When a user loads a page containing the vulnerable player configuration, the browser executes the injected script in the site's origin.

Because execution occurs entirely within the browser, server-side web application firewalls that inspect request bodies may not detect the payload. The scope is marked as changed, meaning script execution can affect resources beyond the vulnerable component. Impact on confidentiality, integrity, and availability is limited to what the victim's browser context permits.

Root Cause

The root cause is failure to neutralize untrusted input before it is inserted into the DOM by client-side code. Data sources such as URL parameters, plugin shortcode attributes, or media configuration values flow into DOM sinks such as innerHTML without proper escaping. This allows HTML and JavaScript payloads to be parsed and executed by the browser.

Attack Vector

An attacker with low-privilege access to a WordPress site, such as a contributor role able to insert plugin shortcodes or media configuration, submits crafted input containing script payloads. When an administrator, editor, or other authenticated user loads a page rendering the affected player, the payload executes in their browser session. The attack requires user interaction and is exploitable over the network.

See the Patchstack Security Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-27325

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload) within stored plugin content or post metadata
Outbound browser requests from WordPress admin sessions to unfamiliar domains shortly after loading pages containing the player
Unauthorized changes to WordPress user accounts, plugin settings, or content following administrator page views

Detection Strategies

Audit WordPress database tables (wp_posts, wp_postmeta, wp_options) for HLS player shortcodes containing script payloads or encoded HTML entities
Inspect web server access logs for requests to pages containing the plugin with suspicious query strings or URL fragments
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on pages using the player

Monitoring Recommendations

Monitor authenticated administrator sessions for anomalous API calls to wp-admin/admin-ajax.php or the REST API
Track plugin version inventory across WordPress deployments to identify installations of videojs-hls-player at version 1.0.2 or earlier
Alert on new administrator account creation or role escalation events following content edits by lower-privilege users

How to Mitigate CVE-2025-27325

Immediate Actions Required

Identify all WordPress sites running the Bruce Video.js HLS Player plugin and check installed versions
Deactivate the videojs-hls-player plugin on any site running version 1.0.2 or earlier until a patched release is confirmed
Review recent contributor and author submissions for suspicious shortcode content and remove injected payloads
Rotate WordPress administrator credentials and invalidate active sessions if exploitation is suspected

Patch Information

At the time of the NVD entry, no patched version was identified. Consult the Patchstack Security Vulnerability Advisory for current patch availability. If no vendor patch is available, plan migration to an alternative HLS player plugin that receives active security maintenance.

Workarounds

Remove or deactivate the plugin until a fixed version is released
Restrict low-privilege roles (contributor, author) from using the plugin's shortcodes through capability management plugins
Deploy a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins
Apply a web application firewall rule to block requests containing script tags or JavaScript URIs directed at plugin endpoints

bash

# Configuration example: deactivate the plugin via WP-CLI
wp plugin deactivate videojs-hls-player
wp plugin list --name=videojs-hls-player --fields=name,status,version