CVE-2025-30599: WP Parallax Content Slider XSS Vulnerability

CVE-2025-30599 Overview

CVE-2025-30599 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Parallax Content Slider plugin for WordPress, developed by wp-maverick. The flaw affects all plugin versions up to and including 0.9.8. It stems from improper neutralization of user-supplied input during web page generation, mapped to [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page.

Critical Impact
Stored XSS enables session hijacking, administrative action forgery, and content defacement in WordPress sites running WP Parallax Content Slider <= 0.9.8.

Affected Products

WP Parallax Content Slider WordPress plugin (wp-parallax-content-slider)
All versions from n/a through 0.9.8
WordPress installations using the wp-maverick-authored plugin

Discovery Timeline

2025-03-24 - CVE-2025-30599 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30599

Vulnerability Analysis

The WP Parallax Content Slider plugin fails to properly sanitize or encode user-controlled input before rendering it inside HTML output. This weakness allows an attacker to persist arbitrary JavaScript in plugin-managed content, such as slider entries or configuration fields. When the affected page loads, the injected script executes in the context of the victim's browser session. Because the payload is stored server-side, the attack persists across sessions and impacts every visitor to the affected page.

The issue is scored using the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The scope change indicates that a successful attack affects resources beyond the vulnerable component, such as an administrator's authenticated browser session.

Root Cause

The root cause is missing output encoding and input sanitization on plugin fields. Data supplied through the plugin's administrative interface is written back to rendered pages without escaping HTML control characters. WordPress provides sanitization primitives such as wp_kses_post() and esc_html(), but the plugin does not consistently apply them to attacker-controllable strings.

Attack Vector

Exploitation requires an authenticated account with high privileges, typically an administrator or editor who can modify plugin content. The attacker injects a payload containing an HTML tag or attribute-based script into a slider field. When a victim, often another administrator, loads the page containing the slider, the browser parses and executes the payload. This can be chained to escalate access by exfiltrating session cookies, altering user roles, or planting persistent backdoors via the WordPress theme or plugin editor.

No verified public proof-of-concept is available. See the Patchstack Vulnerability Advisory for advisory details.

Detection Methods for CVE-2025-30599

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in the wp_posts, wp_postmeta, or wp_options tables associated with the plugin.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading pages containing the slider.
New or modified WordPress administrator accounts with no corresponding change record.

Detection Strategies

Query the WordPress database for stored payloads containing HTML event handlers or script tags in plugin-managed fields.
Review web server access logs for suspicious POST requests to wp-admin/admin.php or admin-ajax.php targeting the WP Parallax Content Slider plugin endpoints.
Deploy a Web Application Firewall (WAF) rule that flags requests containing script fragments in plugin parameters.

Monitoring Recommendations

Monitor privileged account activity, especially plugin configuration changes made outside normal business hours.
Track file integrity for WordPress themes, wp-config.php, and plugin directories to detect secondary tampering following XSS execution.
Alert on browser Content Security Policy (CSP) violation reports referencing WordPress administrative pages.

How to Mitigate CVE-2025-30599

Immediate Actions Required

Audit the installed version of WP Parallax Content Slider and disable it if version 0.9.8 or earlier is present and no fixed release is available.
Rotate WordPress administrator passwords and invalidate active sessions to counter any credential or cookie theft from prior exploitation.
Restrict high-privileged accounts to trusted personnel and enforce multi-factor authentication on all administrative logins.

Patch Information

At the time of publication, no patched version is listed in the advisory; the vulnerability affects all releases through 0.9.8. Site owners should consult the Patchstack Vulnerability Advisory for updated patch status and consider replacing the plugin with an actively maintained alternative.

Workarounds

Remove the WP Parallax Content Slider plugin entirely if a patched release is not available.
Deploy a WAF with virtual patching rules to strip script content from plugin request parameters.
Enforce a strict Content Security Policy that disallows inline scripts in the WordPress administrative interface.
Limit the WordPress unfiltered_html capability and review user role assignments.

bash

# Disable the plugin via WP-CLI until a fix is available
wp plugin deactivate wp-parallax-content-slider
wp plugin delete wp-parallax-content-slider

# Rotate administrator sessions
wp user session destroy --all