CVE-2025-30982: MyBookProgress Stored XSS Vulnerability

CVE-2025-30982 Overview

CVE-2025-30982 is a stored cross-site scripting (XSS) vulnerability in the MyBookProgress by Stormhill Media WordPress plugin developed by zookatron. The flaw affects all versions up to and including 1.0.8. It stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators. The vulnerability requires user interaction and can cross privilege boundaries, changing the security scope of the affected component.

Critical Impact
Authenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and drive-by client-side attacks against site visitors.

Affected Products

MyBookProgress by Stormhill Media WordPress plugin versions up to and including 1.0.8
WordPress installations that have the vulnerable plugin activated
Any site visitor or administrator browsing affected pages

Discovery Timeline

2025-04-15 - CVE-2025-30982 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30982

Vulnerability Analysis

The MyBookProgress plugin fails to sanitize and escape user-supplied input before rendering it back into WordPress pages. When an authenticated user with contributor-level or similar privileges submits crafted content through a vulnerable input field, the plugin stores the payload in the WordPress database without proper neutralization. On subsequent page loads, the plugin outputs the stored input directly into the HTML response, allowing script tags and event handlers to execute in the viewer's browser context.

Because the payload is persisted server-side, every visitor to the affected page becomes a target. Administrators viewing the plugin's content are particularly at risk, as attacker-controlled JavaScript executes with their session cookies and CSRF tokens available. This enables actions such as creating new administrator accounts, modifying plugin settings, or exfiltrating sensitive data.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to user-controlled fields before echoing them into page output. Input sanitization on write and output escaping on read are both absent for the affected fields.

Attack Vector

An attacker with a low-privilege authenticated WordPress account crafts a payload containing malicious JavaScript and submits it through the plugin's input interface. The payload is stored in the database. When another user, typically an administrator or site visitor, loads the page rendering that data, the script executes in their session. The scope change means the injected script can affect resources outside the vulnerable component's original security context.

No verified public exploit code is available for CVE-2025-30982. For technical details, see the Patchstack Security Vulnerability Report.

Detection Methods for CVE-2025-30982

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or DOM event handlers such as onerror and onload stored in wp_posts, wp_postmeta, or plugin-specific tables
New WordPress administrator accounts or role changes with no corresponding audit trail
Outbound HTTP requests from browsers of authenticated administrators to unfamiliar domains after visiting plugin pages
Modifications to WordPress options, theme files, or plugin settings shortly after a low-privilege user submitted plugin content

Detection Strategies

Scan the WordPress database for HTML and JavaScript patterns in fields managed by the MyBookProgress plugin
Review web server access logs for POST requests to plugin endpoints followed by GET requests containing script payloads in responses
Deploy a web application firewall (WAF) rule set that flags stored XSS payloads targeting WordPress plugin parameters
Correlate low-privilege user submissions with subsequent administrative actions to identify session hijacking chains

Monitoring Recommendations

Enable WordPress audit logging to capture user role changes, plugin setting modifications, and content submissions
Monitor Content Security Policy (CSP) violation reports for inline script executions on plugin-rendered pages
Alert on newly created administrator accounts or unexpected privilege escalations within WordPress
Track outbound network connections from administrator browser sessions to detect data exfiltration

How to Mitigate CVE-2025-30982

Immediate Actions Required

Deactivate the MyBookProgress by Stormhill Media plugin until a patched version is confirmed installed
Audit all content stored by the plugin for injected script payloads and remove malicious entries
Force password resets for all WordPress administrator accounts and invalidate active sessions
Restrict contributor and author-level account creation until remediation is verified

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack does not identify a fixed release beyond version 1.0.8. Site owners should monitor the Patchstack advisory and the WordPress plugin repository for an updated release that addresses CVE-2025-30982.

Workarounds

Remove or deactivate the MyBookProgress plugin entirely until a patched version is available
Restrict access to plugin input functionality using role-based access controls or plugins such as User Role Editor
Deploy a WordPress-aware WAF with rules that block stored XSS payloads targeting plugin parameters
Implement a strict Content Security Policy that disallows inline scripts and unauthorized script sources

bash

# Content Security Policy header example for Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate mybookprogress