CVE-2025-53336: My Resume Builder Stored XSS Vulnerability

CVE-2025-53336 Overview

CVE-2025-53336 is a stored Cross-Site Scripting (XSS) vulnerability in the My Resume Builder WordPress plugin by abditsori. The flaw affects all plugin versions up to and including 1.0.3. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79].

An authenticated attacker with low privileges can inject malicious JavaScript payloads that persist in the plugin's stored data. When other users, including administrators, view the affected pages, the script executes in their browser context. The scope-changed CVSS vector indicates that impact extends beyond the vulnerable component.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and administrative account takeover on WordPress sites running the plugin.

Affected Products

abditsori My Resume Builder plugin for WordPress
All versions from initial release through 1.0.3
WordPress sites with the my-resume-builder plugin installed and activated

Discovery Timeline

2025-06-27 - CVE-2025-53336 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53336

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the My Resume Builder WordPress plugin. Stored XSS occurs when an application accepts untrusted input, saves it in persistent storage, and later renders it in a web page without proper escaping. Every user who loads the affected page executes the attacker-controlled script.

The attack requires network access, low privileges, and user interaction to trigger the payload. Because the scope changes when the payload executes, the impact reaches components beyond the vulnerable plugin itself, including the WordPress administrative interface.

Successful exploitation compromises confidentiality, integrity, and availability of the affected site. Attackers commonly use stored XSS to hijack authenticated sessions, plant persistent backdoors in WordPress content, or redirect visitors to malicious infrastructure. See the Patchstack Vulnerability Report for additional technical detail.

Root Cause

The plugin fails to sanitize or escape user-controlled input before rendering it in HTML output. WordPress provides functions such as sanitize_text_field(), wp_kses(), and esc_html() for this purpose. The My Resume Builder plugin does not apply these functions consistently to fields that later render in resume pages or administrative views.

Attack Vector

An attacker authenticates to the target WordPress site with a low-privilege account, such as a subscriber or contributor. The attacker submits a crafted payload containing JavaScript into a plugin input field, for example a resume section, profile field, or configuration option. The payload persists in the WordPress database.

When an administrator or other user views the affected page, the browser parses and executes the injected script. The script runs with the victim's session, enabling cookie theft, unauthorized API calls, or plugin modification. Because scope changes, the payload can act against the broader WordPress admin context rather than only the plugin's own pages.

No verified public exploit code is available for this vulnerability at the time of publication.

Detection Methods for CVE-2025-53336

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= and onload= stored in plugin-related database tables
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after viewing resume pages
New or modified WordPress administrator accounts created without corresponding audit-log activity
Unexpected modifications to plugin files, themes, or wp_options entries following administrator page views

Detection Strategies

Inspect database rows written by the my-resume-builder plugin for HTML tags and JavaScript syntax
Deploy a web application firewall (WAF) with rules that detect XSS payloads in POST requests to plugin endpoints
Enable a strict Content Security Policy (CSP) and monitor report-uri violations for inline script execution attempts
Correlate authenticated low-privilege user activity with subsequent administrator session anomalies

Monitoring Recommendations

Log and review all POST requests to plugin endpoints from non-administrator accounts
Monitor WordPress user role changes and new account creation for unauthorized privilege escalation
Alert on outbound connections from administrator browsers to newly registered or low-reputation domains
Track plugin file integrity using checksum baselines against known-good plugin versions

How to Mitigate CVE-2025-53336

Immediate Actions Required

Deactivate and remove the My Resume Builder plugin until a patched version is confirmed available
Audit all low-privilege WordPress accounts and remove unused or suspicious users
Force a password reset and session invalidation for all administrator accounts
Review plugin-related database tables and remove any entries containing script tags or JavaScript event handlers

Patch Information

No fixed version is identified in the enriched CVE data. The vulnerability affects My Resume Builder versions up to and including 1.0.3. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release before reinstalling.

Workarounds

Remove the plugin entirely if no patched version is available
Restrict registration and lower-privilege account creation on the affected WordPress site
Deploy a WAF ruleset that blocks XSS payloads targeting my-resume-builder request paths
Implement a strict Content Security Policy that disallows inline scripts and unknown script sources

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate my-resume-builder
wp plugin uninstall my-resume-builder

# Verify no plugin files remain
ls -la wp-content/plugins/ | grep -i my-resume-builder