CVE-2025-29011: YouTube Simple Gallery Stored XSS Vulnerability

CVE-2025-29011 Overview

CVE-2025-29011 is a stored Cross-Site Scripting (XSS) vulnerability in the CHR Designer YouTube Simple Gallery plugin for WordPress. The flaw affects all versions of youtube-simple-gallery up to and including 2.2.0. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent JavaScript payloads. Stored payloads execute in the browsers of visitors and administrators who view affected pages. The issue is tracked under CWE-79.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes in visitor browsers, enabling session theft, administrative account takeover, and site defacement across a shared scope boundary.

Affected Products

CHR Designer YouTube Simple Gallery (youtube-simple-gallery) WordPress plugin
All versions from initial release through 2.2.0
WordPress sites with the plugin activated and low-privilege user registration enabled

Discovery Timeline

2025-06-06 - CVE-2025-29011 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29011

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation within the YouTube Simple Gallery plugin. Attackers with contributor-level or higher access can inject arbitrary HTML and JavaScript through plugin input fields. The injected content persists in the WordPress database and renders whenever affected pages load. Because the payload executes in an authenticated administrator's browser, the impact extends beyond the initial vulnerable scope, matching the scope-changed classification in the CVSS vector.

Exploitation requires user interaction, meaning a victim must visit or preview the page containing the malicious payload. Successful attacks compromise the confidentiality, integrity, and availability of the affected WordPress installation. Common outcomes include session cookie theft, forced administrative actions through CSRF chaining, and redirection to attacker-controlled infrastructure.

Root Cause

The root cause is missing output encoding and input sanitization on plugin-provided fields. WordPress plugins typically must apply functions such as esc_html(), esc_attr(), wp_kses_post(), or sanitize_text_field() before persisting or rendering user input. The YouTube Simple Gallery plugin omits these safeguards on at least one gallery-related field, allowing raw <script> tags or event-handler attributes to reach the DOM.

Attack Vector

The attack is network-based and requires authenticated access with low privileges. An attacker submits a crafted gallery entry containing an XSS payload through the WordPress admin interface. The payload is stored in the WordPress database and executes when any user renders the containing page. See the Patchstack advisory for advisory details.

Detection Methods for CVE-2025-29011

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_posts or plugin-specific database tables
Outbound requests from administrator browsers to unfamiliar domains after visiting gallery pages
New administrator accounts or modified user roles following contributor activity on gallery content
Presence of the youtube-simple-gallery plugin at version 2.2.0 or earlier

Detection Strategies

Audit the WordPress database for gallery entries containing HTML tags, encoded script fragments, or suspicious URL schemes
Review web server access logs for POST requests to plugin admin endpoints originating from low-privilege accounts
Monitor Content Security Policy (CSP) violation reports if a policy is deployed on the site
Correlate contributor login events with subsequent gallery modifications for anomaly detection

Monitoring Recommendations

Enable WordPress activity logging to capture plugin configuration changes and content submissions
Forward web server, application, and authentication logs to a centralized analytics platform for retention and query
Alert on creation or modification of gallery entries by non-administrator accounts
Track plugin version inventory across WordPress deployments to identify unpatched instances

How to Mitigate CVE-2025-29011

Immediate Actions Required

Identify all WordPress sites running the youtube-simple-gallery plugin at version 2.2.0 or earlier
Deactivate the plugin on affected sites until a patched version is confirmed available
Review contributor and author accounts for suspicious activity or unauthorized privilege changes
Rotate administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry for CVE-2025-29011. Consult the Patchstack advisory for current patch status and vendor updates. Apply any vendor-released update immediately once available.

Workarounds

Remove or deactivate the YouTube Simple Gallery plugin until a fix is published
Restrict contributor and author registration on public-facing WordPress sites
Deploy a Web Application Firewall (WAF) rule blocking <script> and event-handler payloads in plugin request parameters
Implement a strict Content Security Policy that disallows inline script execution

bash

# Locate and disable the vulnerable plugin via WP-CLI
wp plugin list --name=youtube-simple-gallery --fields=name,status,version
wp plugin deactivate youtube-simple-gallery