CVE-2025-53562: WPBakery Video Player XSS Vulnerability

CVE-2025-53562 Overview

CVE-2025-53562 is a reflected Cross-Site Scripting (XSS) vulnerability in the LambertGroup Universal Video Player Addon for WPBakery Page Builder, a WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. Attackers can craft malicious URLs that, when clicked by a victim, execute arbitrary JavaScript in the victim's browser session under the WordPress site's origin. The issue affects all plugin versions from inception through 3.2.1. Successful exploitation can lead to session hijacking, credential theft, defacement, and pivoting to administrative actions when a logged-in privileged user is targeted.

Critical Impact

Reflected XSS executes attacker-controlled JavaScript in the context of the vulnerable WordPress site, enabling session theft and unauthorized actions against site administrators.

Affected Products

• LambertGroup Universal Video Player - Addon for WPBakery Page Builder (lbg_universal_video_player_addon_visual_composer)
• All versions from initial release through 3.2.1
• WordPress installations using the affected plugin with WPBakery Page Builder

Discovery Timeline

• 2025-08-20 - CVE-2025-53562 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-53562

Vulnerability Analysis

The vulnerability is a reflected XSS issue classified under [CWE-79]. The plugin accepts user-supplied input through HTTP request parameters and embeds the input into rendered HTML output without proper sanitization or output encoding. An attacker crafts a URL containing JavaScript payloads in vulnerable parameters and delivers it through phishing, malvertising, or third-party links. When the victim's browser requests the URL, the plugin reflects the payload into the response, and the browser executes the script in the context of the WordPress origin.

Exploitation requires user interaction (UI:R) since the victim must click or visit the crafted link. The scope is changed (S:C), indicating the attacker can affect resources beyond the vulnerable component, such as other browser contexts or session data tied to the WordPress origin.

Root Cause

The root cause is missing input validation and missing output encoding in the plugin's request-handling code. Parameter values reach the HTML rendering layer without escaping characters such as <, >, ", and '. The plugin does not apply WordPress sanitization helpers like esc_html(), esc_attr(), or wp_kses() before echoing data into the response.

Attack Vector

The attack vector is network-based and requires no authentication. The attacker constructs a URL pointing to a vulnerable endpoint on the target WordPress site with a JavaScript payload embedded in a reflected parameter. Delivery typically occurs via email, social media, or a third-party page. When an authenticated administrator triggers the link, the attacker can issue requests on the admin's behalf, exfiltrate session cookies, or modify site content. See the Patchstack WordPress Vulnerability advisory for additional context.

Detection Methods for CVE-2025-53562

Indicators of Compromise

• HTTP request logs containing URL parameters with <script>, javascript:, onerror=, or onload= patterns targeting plugin endpoints.
• Outbound requests from administrator browsers to unknown domains shortly after clicking external links to the WordPress site.
• Unexpected creation of administrative users or modification of plugin and theme files following admin activity.
• Anomalous wp-admin POST requests originating from sessions immediately after the admin visited a referrer outside the site.

Detection Strategies

• Inspect web server access logs for query strings containing HTML or JavaScript metacharacters directed at plugin paths.
• Deploy a Web Application Firewall (WAF) rule set covering OWASP CRS XSS signatures for WordPress traffic.
• Apply Content Security Policy (CSP) reporting endpoints to capture script execution violations on plugin-rendered pages.

Monitoring Recommendations

• Enable WordPress audit logging to track administrative actions, user creation, and option changes.
• Monitor for new or modified files in wp-content/plugins/ and wp-content/themes/ outside of scheduled update windows.
• Alert on session cookie use from geographically inconsistent IP addresses for privileged accounts.

How to Mitigate CVE-2025-53562

Immediate Actions Required

• Identify all WordPress sites running Universal Video Player - Addon for WPBakery Page Builder at version 3.2.1 or earlier.
• Update the plugin to a fixed release once published by LambertGroup, or deactivate and remove the plugin until a patch is available.
• Force a password reset and session invalidation for all administrator accounts that may have interacted with untrusted links.
• Review the Patchstack advisory for current remediation guidance.

Patch Information

At the time of NVD publication, the vulnerability affects all versions up to and including 3.2.1. Site operators should monitor the Patchstack advisory and the LambertGroup vendor channel for a fixed release and apply it as soon as it is available.

Workarounds

• Deactivate the plugin until a vendor patch is released if the functionality is non-essential.
• Deploy a virtual patch through a WAF that blocks requests containing script tags, event handlers, or javascript: URIs against plugin endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
• Restrict administrator browsing habits and require admins to use a separate browser profile that does not follow external links.

# Example WAF rule (ModSecurity) to block reflected XSS payloads in plugin parameters
SecRule REQUEST_URI "@contains lbg_universal_video_player" \
  "chain,id:1005356,phase:2,deny,status:403,msg:'Block XSS attempt on Universal Video Player addon'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:none,t:urlDecodeUni"