CVE-2025-27326: Video Gallery Block Stored XSS Vulnerability

CVE-2025-27326 Overview

CVE-2025-27326 is a stored Cross-Site Scripting (XSS) vulnerability in the bPlugins Video Gallery Block plugin for WordPress. The flaw affects all versions up to and including 1.1.0. It stems from improper neutralization of user-supplied input during web page generation, tracked as [CWE-79]. An authenticated attacker with contributor-level access or higher can inject persistent JavaScript payloads. The stored payload executes in the browser of any visitor rendering the affected page, enabling session theft, redirects, or drive-by delivery of secondary payloads.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes across visitor sessions, enabling account takeover through cookie theft and administrative privilege escalation via cross-context script execution.

Affected Products

bPlugins Video Gallery Block (video-gallery-block) WordPress plugin
All versions from initial release through 1.1.0
WordPress sites with contributor-level or higher user registration enabled

Discovery Timeline

2025-07-04 - CVE-2025-27326 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27326

Vulnerability Analysis

The Video Gallery Block plugin renders user-supplied block attributes into the WordPress post output without sufficient sanitization or output encoding. When a contributor or editor configures a video gallery block, one or more attribute fields accept arbitrary strings that are later inserted into the rendered HTML. Because the plugin fails to apply WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post() to these attributes, an attacker can embed JavaScript payloads that persist in the database and execute in every visitor's browser.

The stored nature of this XSS distinguishes it from reflected variants. The payload survives across page loads and affects every user rendering the affected block. The scope change indicated by the CVSS vector reflects that injected script executes in the browser context of other users, including administrators. Successful exploitation permits session cookie theft, unauthorized administrative actions via the WordPress REST API, and pivoting to full site compromise.

Root Cause

The root cause is missing output encoding for block attributes in the plugin's server-side render callback. WordPress block plugins must sanitize attributes on save and escape them on render. The Video Gallery Block plugin omits one or both steps for at least one attribute field through version 1.1.0.

Attack Vector

Exploitation requires an authenticated account with post editing privileges. The attacker inserts a Video Gallery Block into a post or page and supplies a crafted attribute value containing an HTML event handler or <script> payload. Once the post is published or previewed by another user, the browser executes the injected script under the site's origin.

No verified proof-of-concept code is publicly available. See the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-27326

Indicators of Compromise

Post content or wp_posts rows containing Video Gallery Block markup with <script>, onerror=, onload=, or javascript: strings inside attributes
Unexpected outbound requests from visitor browsers to attacker-controlled domains referenced from affected pages
New administrator accounts or modified user roles following publication of a Video Gallery Block by a lower-privileged user
WordPress audit log entries showing post edits by contributors immediately followed by administrator session activity

Detection Strategies

Query the WordPress database for wp:video-gallery-block block comments containing HTML event handler patterns or script tags
Deploy a web application firewall rule that inspects POST /wp-json/wp/v2/posts and admin-ajax.php payloads for script injection patterns in block attributes
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages containing the plugin's blocks

Monitoring Recommendations

Alert on privilege changes and new administrator account creation events in WordPress logs
Track plugin version inventory across WordPress sites and flag any instance running video-gallery-block at version 1.1.0 or earlier
Enable request logging on /wp-admin/ and REST API endpoints to correlate contributor edits with subsequent anomalous administrative actions

How to Mitigate CVE-2025-27326

Immediate Actions Required

Update the Video Gallery Block plugin to a version later than 1.1.0 once a patched release is published by bPlugins
Audit all existing posts and pages containing the Video Gallery Block for injected script content and remove malicious payloads
Review contributor, author, and editor accounts for unauthorized additions and rotate credentials for any suspicious users
Force a password reset for administrator accounts if evidence of session hijacking is present

Patch Information

At the time of publication, the advisory identifies all versions through 1.1.0 as affected. Site administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for a fixed release, then apply it across all environments.

Workarounds

Deactivate and remove the Video Gallery Block plugin until a patched version is available
Restrict post-creation privileges by limiting contributor and author roles to trusted users only
Deploy a virtual patch through a WordPress-aware web application firewall to block script injection into block attributes
Implement a strict Content Security Policy that disallows inline scripts on public pages to limit XSS payload execution

bash

# Disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate video-gallery-block --all
wp plugin delete video-gallery-block

# Audit posts for suspicious script content in Video Gallery blocks
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%wp:video-gallery-block%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"