CVE-2025-30780: Audio Album Plugin Stored XSS Vulnerability

CVE-2025-30780 Overview

CVE-2025-30780 is a stored Cross-Site Scripting (XSS) vulnerability in the cubecolour Audio Album WordPress plugin. The flaw affects all versions of Audio Album up to and including 1.5.0. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79].

An authenticated attacker with low privileges can inject malicious JavaScript that persists in the plugin's output. When another user renders the affected page, the payload executes in that user's browser session. The vulnerability requires user interaction and can impact resources beyond the vulnerable component due to the scope-changed CVSS scoring.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of site visitors and administrators, enabling session theft, credential harvesting, and administrative account takeover on WordPress sites running Audio Album ≤ 1.5.0.

Affected Products

cubecolour Audio Album plugin for WordPress
All versions from n/a through 1.5.0
WordPress installations with the plugin activated

Discovery Timeline

2025-03-27 - CVE-2025-30780 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30780

Vulnerability Analysis

The Audio Album plugin fails to sanitize or encode user-controlled input before rendering it into HTML output. This allows an authenticated user to store JavaScript payloads that persist across sessions and users. Stored XSS differs from reflected XSS because the payload lives in the server-side database and executes for every visitor who loads the affected page.

The EPSS score of 0.344% suggests limited near-term exploitation probability, but the persistent nature of the vulnerability increases risk over time. Because the CVSS scope is marked as changed, a successful attack can affect resources beyond the vulnerable plugin, including the broader WordPress admin interface.

Root Cause

The root cause is missing input validation and output encoding in the plugin's shortcode or admin form handlers. Input supplied by an authenticated contributor or higher-privileged user is written to the database without escaping, then rendered directly into HTML markup without contextual encoding functions such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

Exploitation requires an authenticated account with at least contributor-level privileges and interaction from a victim user. The attacker submits a payload through a plugin input field, saves it, and waits for an administrator or visitor to load the affected page. Once rendered, the injected script executes with the victim's browser privileges within the WordPress domain.

The vulnerability manifests through unescaped rendering of plugin input fields. No verified proof-of-concept code is publicly available. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30780

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or JavaScript URIs stored in Audio Album database entries
Outbound requests from administrator browsers to unfamiliar domains after loading plugin pages
New or modified WordPress administrator accounts created shortly after admin sessions on affected pages
Anomalous session cookie access patterns in web server logs

Detection Strategies

Audit wp_posts and plugin-specific tables for HTML entities, script tags, or encoded JavaScript in Audio Album fields
Deploy Content Security Policy (CSP) headers in report-only mode to surface inline script violations
Review WordPress activity logs for suspicious content submissions by contributor or author accounts
Scan rendered pages with automated XSS detection tools targeting plugin-generated output

Monitoring Recommendations

Monitor administrative account creation and role changes in WordPress audit logs
Alert on browser telemetry showing script execution from WordPress admin pages to external hosts
Track failed and successful login attempts from unexpected geographies following plugin page visits
Ingest WordPress and web server logs into a centralized SIEM for correlation across sessions

How to Mitigate CVE-2025-30780

Immediate Actions Required

Deactivate and remove the Audio Album plugin until a patched version is confirmed available
Restrict contributor and author account creation to trusted users only
Reset passwords and invalidate active sessions for administrator accounts that visited affected pages
Review recently created WordPress accounts and remove any unauthorized users

Patch Information

No vendor patch is referenced in the available advisory data for versions above 1.5.0. Administrators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for a fixed release. Until a patch ships, treat the plugin as vulnerable on all installations.

Workarounds

Remove the Audio Album plugin from production WordPress sites
Deploy a Web Application Firewall (WAF) rule blocking script tags and event handlers in plugin request parameters
Enforce a strict Content Security Policy that disallows inline scripts on WordPress admin pages
Limit plugin usage to trusted, authenticated editors and audit their submissions regularly

bash

# Example WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate audio-album
wp plugin delete audio-album

# Example CSP header for nginx to mitigate stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;