CVE-2025-53206: HT Mega WPBakery Stored XSS Vulnerability

CVE-2025-53206 Overview

CVE-2025-53206 is a stored cross-site scripting (XSS) vulnerability in the HT Mega – Absolute Addons for WPBakery Page Builder WordPress plugin by HT Plugins. The flaw stems from improper neutralization of user input during web page generation, classified as [CWE-79]. Authenticated contributors can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The issue affects all plugin versions up to and including 1.0.8. Successful exploitation requires low-privilege authenticated access and user interaction, and results in cross-site scripted content that crosses a security scope boundary.

Critical Impact
Stored XSS enables persistent script execution against site visitors and administrators, enabling session theft, account takeover, and administrative action hijacking.

Affected Products

HT Mega – Absolute Addons for WPBakery Page Builder plugin for WordPress
All versions from n/a through 1.0.8
Deployments integrating the plugin with WPBakery Page Builder

Discovery Timeline

2025-06-27 - CVE-2025-53206 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53206

Vulnerability Analysis

The vulnerability resides in the HT Mega plugin's handling of user-supplied input rendered into WordPress pages built with WPBakery Page Builder. The plugin fails to sanitize or escape input before writing it to the generated HTML. An authenticated user with content-editing privileges can inject HTML or JavaScript into a page element. When another user loads the affected page, the browser parses and executes the attacker-controlled script in the context of the hosting site.

Because the payload persists in the WordPress database, every visitor to the compromised page triggers execution. The CVSS vector indicates a changed scope, meaning the injected script can affect resources beyond the vulnerable component. Attackers typically weaponize stored XSS to steal authentication cookies, forge administrative requests, or deliver follow-on payloads such as cryptominers or redirects.

Root Cause

The root cause is missing output encoding and insufficient input validation in plugin shortcodes or widget attributes rendered by HT Mega. User-supplied values flow into the DOM without being passed through WordPress APIs such as esc_html(), esc_attr(), or wp_kses_post(), allowing raw HTML and <script> tags to render.

Attack Vector

Exploitation requires an authenticated account with contributor-level or higher privileges to create or edit content containing HT Mega elements. The attacker embeds a malicious payload in a plugin field. Victim interaction, such as previewing or viewing the page, triggers execution. Refer to the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-53206

Indicators of Compromise

Unexpected <script>, <iframe>, or on* event handler attributes stored in WordPress post content or postmeta entries created by HT Mega widgets
Outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendered with the HT Mega plugin
New or modified administrator accounts following contributor activity on pages using HT Mega elements

Detection Strategies

Query the WordPress database for HT Mega shortcodes containing script tags, javascript: URIs, or encoded payloads such as <script
Review web server access logs for unusual POST requests to admin-ajax.php or wp-admin/post.php from low-privilege accounts editing HT Mega content
Deploy Content Security Policy (CSP) report-only mode to surface inline script violations originating from plugin-rendered pages

Monitoring Recommendations

Monitor WordPress audit logs for post edits and shortcode changes by contributor and author roles
Alert on anomalous session activity from administrator accounts, particularly cookie reuse across geographic regions
Track plugin version inventories against the vulnerable range of ≤ 1.0.8

How to Mitigate CVE-2025-53206

Immediate Actions Required

Identify all WordPress sites running HT Mega – Absolute Addons for WPBakery Page Builder at version 1.0.8 or earlier
Audit existing posts and widgets rendered by HT Mega for injected HTML or script payloads and remove any malicious content
Restrict contributor and author account creation and review existing low-privilege accounts for signs of abuse

Patch Information

Consult the vendor and the Patchstack XSS Vulnerability Report for the latest fixed release. Upgrade to a patched version above 1.0.8 once published by HT Plugins. If no fixed version is available, treat the plugin as vulnerable and apply compensating controls.

Workarounds

Disable or uninstall the HT Mega – Absolute Addons for WPBakery Page Builder plugin until a patched version is installed
Enforce a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Deploy a WordPress-aware web application firewall rule to block requests containing XSS payloads targeting HT Mega shortcodes
Limit editorial privileges so untrusted users cannot create or modify content rendered through the plugin

bash

# Configuration example: WordPress WP-CLI commands to deactivate the plugin
wp plugin deactivate ht-mega-for-wpbakery
wp plugin status ht-mega-for-wpbakery