CVE-2025-30860: Off-Canvas Sidebars XSS Vulnerability

CVE-2025-30860 Overview

CVE-2025-30860 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all plugin versions up to and including 0.5.8.2.

An attacker with low-privileged authenticated access can inject malicious script content that executes in the browser context of a victim who interacts with a crafted link or page element. The scope is changed, meaning injected scripts can affect resources beyond the vulnerable component.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session data theft, unauthorized actions on behalf of the user, and potential pivoting into WordPress administrative functions.

Affected Products

Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) WordPress plugin
Plugin slug: off-canvas-sidebars
All versions from n/a through <= 0.5.8.2

Discovery Timeline

2025-03-27 - CVE-2025-30860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30860

Vulnerability Analysis

The vulnerability is classified under [CWE-79], Improper Neutralization of Input During Web Page Generation. The plugin fails to sanitize or encode user-controlled input before it reaches a DOM sink in client-side JavaScript. When the browser processes this untrusted input, it interprets attacker-controlled content as executable script.

DOM-based XSS differs from stored or reflected variants because the injection and execution occur entirely in the client. The malicious payload never needs to touch the server-side rendering path. This makes traditional server-side web application firewall (WAF) inspection less effective at blocking the attack.

Exploitation requires low-privilege authentication and user interaction. An attacker typically crafts a URL or triggers a plugin feature that reflects controlled input into a DOM sink such as innerHTML or document.write.

Root Cause

The root cause is missing output encoding and input validation in the plugin's client-side code paths that render sidebar and menu configuration data. Values sourced from URL fragments, query parameters, or plugin settings are passed to DOM manipulation functions without sanitization.

Attack Vector

The attack vector is network-based and requires authenticated access at a low privilege tier along with victim interaction. An attacker delivers a crafted link to a logged-in WordPress user. When the victim loads the page, the plugin's JavaScript reads attacker-controlled data and injects it into the DOM as executable script.

Because the vulnerability produces a scope change, the injected script can access data and issue requests beyond the plugin boundary. This includes reading authenticated session tokens, exfiltrating administrative content, and issuing privileged requests against the WordPress REST API.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30860

Indicators of Compromise

Unexpected <script> tags or JavaScript event handlers appearing within rendered Slidebars sidebar or menu content.
Outbound requests from WordPress user browsers to unfamiliar domains immediately after loading pages that include the plugin.
Anomalous WordPress REST API calls originating from authenticated user sessions shortly after visiting attacker-supplied URLs.
Log entries showing suspicious query strings or URL fragments referencing plugin endpoints under off-canvas-sidebars.

Detection Strategies

Inventory WordPress installations to identify sites running off-canvas-sidebars at version 0.5.8.2 or earlier.
Enable Content Security Policy (CSP) reporting to surface inline script execution attempts on pages that use the plugin.
Review web server access logs for requests containing URL-encoded HTML tags, JavaScript scheme references, or event handler attributes targeting plugin URLs.

Monitoring Recommendations

Monitor WordPress administrator and editor sessions for unusual actions performed immediately after external link navigation.
Alert on new or modified WordPress users, plugin installations, or theme file edits following suspicious page loads.
Track browser telemetry for CSP violation reports referencing pages that embed the Slidebars plugin.

How to Mitigate CVE-2025-30860

Immediate Actions Required

Identify all WordPress sites running the Off-Canvas Sidebars & Menus (Slidebars) plugin at version 0.5.8.2 or earlier.
Update the plugin to a patched release once the maintainer publishes a fix, or deactivate and remove the plugin if no fix is available.
Rotate credentials and session tokens for any WordPress accounts that may have interacted with untrusted links referencing the plugin.
Audit WordPress user accounts, roles, and installed plugins for unauthorized changes.

Patch Information

As of the last NVD update on 2026-06-17, the vulnerability affects all versions up to and including 0.5.8.2. Consult the Patchstack Vulnerability Report for the current patched version and upgrade guidance.

Workarounds

Deactivate the off-canvas-sidebars plugin until a patched version is confirmed available and deployed.
Restrict low-privileged account creation and enforce least-privilege access on WordPress sites running the plugin.
Deploy a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins.
Configure a WordPress-aware web application firewall to filter requests containing script payloads targeted at plugin endpoints.

bash

# Example CSP header to limit XSS impact on affected WordPress sites
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'" always;