CVE-2025-30553: GMO Font Agent Stored XSS Vulnerability

CVE-2025-30553 Overview

CVE-2025-30553 is a stored Cross-Site Scripting (XSS) vulnerability in the Z.com byGMO GMO Font Agent WordPress plugin. The flaw stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79]. All versions of the gmo-font-agent plugin up to and including 1.6 are affected. An authenticated attacker with low privileges can inject malicious script content that persists in the application and executes in the browsers of subsequent visitors, including administrators.

Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account compromise when a privileged user views the injected payload.

Affected Products

Z.com byGMO GMO Font Agent plugin for WordPress
Versions from unspecified initial release through 1.6
WordPress sites with the gmo-font-agent plugin installed and activated

Discovery Timeline

2025-03-24 - CVE-2025-30553 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30553

Vulnerability Analysis

The vulnerability resides in the GMO Font Agent plugin's handling of user-controlled input rendered into WordPress pages. The plugin fails to sanitize or encode input before storing it and reflecting it in generated HTML. Attackers can persist JavaScript payloads in plugin-managed fields, and the payload executes when any user loads the affected page.

Exploitation requires an authenticated session with low privileges and user interaction from a victim. Because the scope changes to affect other users' browser contexts, a single injection can impact administrators and site visitors. Successful exploitation permits actions performed in the victim's authenticated context, including cookie theft, session hijacking, arbitrary administrative actions, and delivery of secondary payloads.

Root Cause

The root cause is missing output encoding and input sanitization in plugin components that emit user-controlled data into the WordPress DOM. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for context-aware escaping. The GMO Font Agent plugin does not consistently apply these routines to affected fields, allowing HTML and script tags to be stored and later rendered as executable markup.

Attack Vector

An attacker authenticates to WordPress with at least a low-privileged role that has access to the plugin's input surface. The attacker submits a crafted payload containing HTML or JavaScript into a vulnerable field. The payload is stored in the WordPress database and rendered without escaping when a subsequent user, typically an administrator, loads the page hosting that data. The injected script executes under the origin of the WordPress site.

No verified public exploit or proof-of-concept code was available at the time of publication. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-30553

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example onerror, onload) stored in WordPress database tables associated with the gmo-font-agent plugin.
Administrator sessions exhibiting outbound requests to unfamiliar domains shortly after loading plugin-managed pages.
New or modified WordPress administrator accounts created without a corresponding legitimate change ticket.
Browser console errors or Content Security Policy (CSP) violations on pages rendered by the plugin.

Detection Strategies

Query the wp_options, wp_postmeta, and plugin-specific tables for stored values containing HTML tags, JavaScript URI schemes, or encoded script fragments.
Deploy Web Application Firewall (WAF) rules that detect XSS payload patterns targeting gmo-font-agent endpoints.
Correlate authenticated POST requests to plugin admin endpoints with subsequent anomalous administrator activity.

Monitoring Recommendations

Enable WordPress audit logging for plugin settings changes and content modifications by low-privileged accounts.
Monitor administrator browser telemetry for script-initiated requests originating from WordPress admin URLs.
Alert on creation of new administrative users, changes to user roles, and modifications to active theme or plugin files.

How to Mitigate CVE-2025-30553

Immediate Actions Required

Update the GMO Font Agent plugin to a version later than 1.6 once the vendor releases a fixed build.
Audit all WordPress accounts and remove unnecessary low-privileged accounts with access to plugin input surfaces.
Inspect plugin-managed content for previously injected payloads and remove any malicious HTML or JavaScript.
Rotate administrator credentials and invalidate active sessions if injection is confirmed.

Patch Information

At the time of NVD publication, the advisory listed affected versions from unspecified initial release through 1.6. Consult the Patchstack XSS Vulnerability Report for the current fixed version and vendor-supplied patch details.

Workarounds

Deactivate and remove the gmo-font-agent plugin until a patched release is verified.
Restrict access to WordPress admin endpoints using network controls or HTTP authentication.
Deploy a Content Security Policy (CSP) that disallows inline scripts and untrusted script sources to reduce XSS impact.
Apply virtual patching through a WAF to block XSS payload patterns directed at plugin endpoints.

bash

# Content Security Policy header example for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'; base-uri 'self';" always;

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate gmo-font-agent
wp plugin delete gmo-font-agent