CVE-2025-30928: WP Biographia Stored XSS Vulnerability

CVE-2025-30928 Overview

CVE-2025-30928 is a stored Cross-Site Scripting (XSS) vulnerability in the WP Biographia WordPress plugin developed by vicchi. The flaw affects all versions of the plugin up to and including 4.0.0. It stems from improper neutralization of user-supplied input during web page generation, tracked under [CWE-79]. An authenticated attacker with elevated privileges can inject malicious JavaScript that executes in the browsers of users viewing affected pages. The scope is changed, meaning injected scripts can impact resources beyond the vulnerable component.

Critical Impact
Attackers with high privileges can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced actions, and content manipulation.

Affected Products

WP Biographia plugin for WordPress by vicchi
All versions from initial release through 4.0.0
WordPress sites where the plugin is installed and active

Discovery Timeline

2025-06-06 - CVE-2025-30928 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30928

Vulnerability Analysis

The WP Biographia plugin fails to sanitize input supplied through plugin-managed fields before rendering it in generated HTML output. This allows script content submitted by a privileged user to persist in the database and later execute in the browsers of anyone loading the affected page.

Because the injection is stored, the payload triggers automatically for each visitor without further attacker interaction beyond the initial submission. User interaction is still required to view the compromised page, which is reflected in the exploit conditions.

The changed scope indicates that the injected script can affect the WordPress site context beyond the plugin boundary. This includes reading cookies, invoking administrative REST endpoints, and modifying rendered content for authenticated administrators.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders biographical content and related fields into WordPress page output. Input that should be escaped through functions such as esc_html(), esc_attr(), or wp_kses() is instead rendered directly.

Attack Vector

An attacker with high privileges on the WordPress instance submits crafted HTML or JavaScript through a plugin field. The payload is stored in the database. When a victim, including an administrator, loads a page that includes the plugin output, the injected script executes with the origin of the WordPress site.

Exploitation requires network access to the WordPress site, authenticated high-privilege access to submit the payload, and user interaction to load the affected page. Refer to the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-30928

Indicators of Compromise

Unexpected <script> tags, on* event handler attributes, or javascript: URIs stored in WP Biographia plugin fields within the wp_options or wp_usermeta tables.
Outbound requests from visitor browsers to attacker-controlled domains originating from pages that render biography content.
Newly created administrator accounts or unexpected changes to user roles following administrator visits to pages containing plugin output.

Detection Strategies

Audit WP Biographia configuration and user biography fields for HTML tags, encoded script payloads, and suspicious URL schemes.
Enable WordPress activity logging to capture plugin setting changes and user profile modifications by privileged accounts.
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on pages rendering plugin output.

Monitoring Recommendations

Monitor web server access logs for anomalous POST requests to plugin administrative endpoints from high-privilege accounts.
Alert on database writes to WP Biographia option keys that contain angle brackets or JavaScript keywords.
Track browser-side errors and CSP violations from pages hosting plugin content to identify active exploitation attempts.

How to Mitigate CVE-2025-30928

Immediate Actions Required

Deactivate the WP Biographia plugin on all affected WordPress sites until a patched release is confirmed available.
Review all existing biography content and plugin configuration fields for previously injected scripts and remove them.
Rotate credentials for administrator accounts and invalidate active WordPress sessions following remediation.

Patch Information

At publication, no fixed version beyond 4.0.0 is listed in the referenced advisory. Consult the Patchstack XSS Vulnerability Advisory for the current patch status and vendor guidance.

Workarounds

Restrict high-privilege WordPress roles to a minimal set of trusted administrators to reduce the population that can submit payloads.
Deploy a web application firewall (WAF) rule set that blocks HTML and JavaScript payloads submitted to plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering plugin content.

bash

# Configuration example
# Disable the plugin via WP-CLI until a patched release is verified
wp plugin deactivate wp-biographia

# Optional: remove the plugin entirely
wp plugin uninstall wp-biographia