CVE-2025-30626: WPBakery Multimedia Slider XSS Flaw

CVE-2025-30626 Overview

CVE-2025-30626 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Multimedia Playlist Slider Addon for WPBakery Page Builder, developed by LambertGroup. This WordPress plugin, identified by its slug lbg_vp_youtube_vimeo_addon_visual_composer, fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious scripts that execute in the context of a victim's browser session.

The vulnerability stems from improper input validation (CWE-79), enabling attackers to craft malicious URLs containing JavaScript payloads. When a victim clicks on such a link, the injected script executes within the trusted context of the WordPress site, potentially leading to session hijacking, credential theft, or further compromise of the affected website.

Critical Impact
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions on behalf of authenticated users, or redirecting users to malicious sites.

Affected Products

Multimedia Playlist Slider Addon for WPBakery Page Builder version 2.1 and earlier
WordPress sites using the lbg_vp_youtube_vimeo_addon_visual_composer plugin
WPBakery Page Builder installations with the affected addon enabled

Discovery Timeline

2025-08-14 - CVE-2025-30626 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30626

Vulnerability Analysis

This Reflected XSS vulnerability exists due to improper neutralization of user input during web page generation within the Multimedia Playlist Slider Addon. The plugin processes URL parameters or form inputs without adequate sanitization or encoding, allowing malicious script content to be reflected back to users in the rendered HTML response.

Reflected XSS attacks require user interaction—typically clicking a malicious link—but can be highly effective in targeted phishing campaigns or when combined with social engineering tactics. The vulnerability affects all versions of the plugin from the initial release through version 2.1.

The attack can be executed remotely over the network, requires no authentication or special privileges on the target system, and affects a changed scope—meaning the vulnerable component and impacted component can be different (e.g., the WordPress plugin is vulnerable, but the user's browser is where the malicious script executes).

Root Cause

The root cause of CVE-2025-30626 is the failure to implement proper input validation and output encoding within the Multimedia Playlist Slider Addon. Specifically, user-controllable data is inserted into the HTML response without being sanitized or escaped, violating secure coding practices for web applications. WordPress plugins handling multimedia content, particularly those integrating with YouTube and Vimeo, often process various URL parameters that, if not properly validated, can serve as injection points for malicious scripts.

Attack Vector

The attack vector is network-based, requiring an attacker to craft a malicious URL containing JavaScript payload and convince a victim to click on it. Common delivery methods include:

Phishing emails containing the malicious link
Social media posts or comments with embedded links
Malicious advertisements redirecting to the crafted URL
Forum posts or comment sections on other websites

When a user visits the malicious URL, the unvalidated input is reflected in the page response and executed as JavaScript in the user's browser. This execution occurs within the security context of the vulnerable WordPress site, granting the malicious script access to session cookies, DOM content, and the ability to perform authenticated actions.

The vulnerability is described as affecting the web page generation process where user-supplied parameters are reflected without proper encoding. For detailed technical information about the specific vulnerable code paths, see the Patchstack security advisory.

Detection Methods for CVE-2025-30626

Indicators of Compromise

Unexpected JavaScript code appearing in URL parameters for pages using the Multimedia Playlist Slider Addon
Web server logs containing URLs with encoded <script> tags, event handlers (e.g., onerror, onload), or javascript: protocol strings
User reports of unexpected redirects or browser behavior when visiting multimedia slider pages
Anomalous POST requests or cookie exfiltration attempts in network traffic logs

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block common XSS payload patterns in incoming requests
Implement Content Security Policy (CSP) headers to restrict inline script execution and report violations
Monitor web server access logs for requests containing suspicious URL-encoded characters and script injection patterns
Utilize endpoint detection and response (EDR) solutions to identify browser-based exploitation attempts

Monitoring Recommendations

Enable detailed access logging on WordPress installations and review logs for suspicious request patterns
Configure browser-based detection tools to identify XSS exploitation attempts through CSP violation reporting
Monitor for unusual outbound connections from user browsers that may indicate data exfiltration
Set up alerts for any access to WordPress admin functions from unexpected referrers or IP addresses

How to Mitigate CVE-2025-30626

Immediate Actions Required

Identify all WordPress installations using the Multimedia Playlist Slider Addon for WPBakery Page Builder
Consider temporarily deactivating the plugin until a patched version is available, if the functionality is not critical
Implement WAF rules to filter XSS attack patterns targeting the affected plugin
Review user access and session activity for signs of compromise
Educate users about the risks of clicking unfamiliar links that point to the WordPress site

Patch Information

At the time of this advisory, all versions of the Multimedia Playlist Slider Addon for WPBakery Page Builder through version 2.1 are affected. Site administrators should monitor the plugin's official release channels and the Patchstack vulnerability database for updates regarding a security patch. When a patched version becomes available, update immediately through the WordPress plugin management interface.

Workarounds

Deploy a Web Application Firewall with XSS filtering capabilities to block malicious requests
Implement strict Content Security Policy (CSP) headers to prevent inline script execution
Disable the Multimedia Playlist Slider Addon temporarily if it is not essential for site operations
Restrict access to pages using the vulnerable component to authenticated users only
Consider using alternative multimedia slider solutions until a patch is released

bash

# Example: Add Content Security Policy header in Apache .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"

# Example: Add CSP header in Nginx configuration
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";