CVE-2025-53559: WPBakery Video Player Addon XSS Flaw

CVE-2025-53559 Overview

CVE-2025-53559 is a reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup Universal Video Player Addon for WPBakery Page Builder, a WordPress plugin distributed as lbg-universal-video-player-addon-visual-composer. The plugin fails to properly neutralize user-supplied input before reflecting it into generated web pages. The flaw affects all versions up to and including 3.2.1. An attacker can craft a malicious URL that, when visited by an authenticated user, executes attacker-controlled JavaScript in the victim's browser context. The vulnerability is categorized under CWE-79.

Critical Impact

Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, leading to session hijacking, credential theft, or unauthorized actions on the WordPress site.

Affected Products

• LambertGroup Universal Video Player Addon for WPBakery Page Builder versions up to and including 3.2.1
• WordPress sites using the lbg-universal-video-player-addon-visual-composer plugin
• All deployments without a patched plugin release applied

Discovery Timeline

• 2025-08-20 - CVE-2025-53559 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-53559

Vulnerability Analysis

The vulnerability stems from improper neutralization of input during web page generation within the Universal Video Player Addon. The plugin reflects user-controllable parameters into HTML output without applying contextual output encoding or input sanitization. Attackers deliver the payload through a crafted URL or form submission that the victim must interact with, satisfying the user-interaction requirement noted in the vulnerability metadata.

Because the attack crosses a security boundary into the rendering context of the WordPress site, the scope of impact extends beyond the vulnerable component. An attacker who triggers this XSS against a logged-in administrator can perform actions in the administrator's session, including content modification, user manipulation, or plugin configuration changes.

Root Cause

The root cause is missing or insufficient sanitization of request parameters processed by the plugin before they are echoed back into HTML responses. WordPress provides escaping functions such as esc_html(), esc_attr(), and esc_url() that should be applied based on the output context. The affected versions of the plugin omit or misuse these protections on at least one reflected parameter path.

Attack Vector

Exploitation occurs over the network and requires the victim to click a malicious link or load attacker-supplied content. No authentication is required by the attacker, but the victim must have an active session for impact to extend to authenticated actions. The malicious payload is reflected into the response body of a page served by the vulnerable plugin endpoint, where the browser parses and executes the injected script.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-53559

Indicators of Compromise

• HTTP request logs containing URL parameters with <script>, javascript:, onerror=, or onload= patterns targeting plugin endpoints
• Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after clicking external links
• WordPress audit log entries showing unexpected administrative actions originating from a single authenticated session

Detection Strategies

• Inspect web server access logs for requests to plugin URLs containing encoded script payloads such as %3Cscript%3E or %22onerror%3D
• Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS signatures targeting WordPress plugin paths
• Correlate referrer headers with reflected parameter values to identify replay of crafted phishing URLs

Monitoring Recommendations

• Monitor WordPress administrative sessions for anomalous activity following plugin page access
• Alert on plugin file integrity changes and unauthorized configuration updates
• Track browser console errors and Content Security Policy (CSP) violation reports submitted by client browsers

How to Mitigate CVE-2025-53559

Immediate Actions Required

• Disable the Universal Video Player Addon for WPBakery Page Builder until a patched version is verified and deployed
• Invalidate active administrator sessions and require credential resets for users with elevated privileges
• Restrict access to WordPress administrative pages by IP allowlist where operationally feasible

Patch Information

At the time of NVD publication, the advisory indicates the vulnerability affects all versions through 3.2.1, with no fixed version explicitly listed in the available data. Administrators should consult the Patchstack Vulnerability Report and the LambertGroup vendor channels for the latest patched release and apply it as soon as it becomes available.

Workarounds

• Deploy a strict Content Security Policy (CSP) that disallows inline scripts and untrusted external script sources
• Configure WAF rules to block requests containing script-injection signatures aimed at plugin endpoints
• Train administrators to avoid clicking unverified links to the WordPress site, particularly those carrying long query strings

# Example WAF rule (ModSecurity) to block reflected XSS payloads targeting the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/lbg-universal-video-player-addon-visual-composer/" \
    "chain,phase:2,deny,status:403,id:1005355,msg:'Blocked potential XSS targeting Universal Video Player Addon'"
    SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"