CVE-2025-57964: Library Bookshelves Stored XSS Vulnerability

CVE-2025-57964 Overview

CVE-2025-57964 is a stored Cross-Site Scripting (XSS) vulnerability in the photonicgnostic Library Bookshelves WordPress plugin. The flaw affects all versions of library-bookshelves up to and including 5.11. Attackers with low-privilege authenticated access can inject malicious script content that persists in the plugin's stored data. When another user renders the affected page, the browser executes the injected payload in the context of the WordPress site.

The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative action forgery against WordPress users who view attacker-controlled bookshelf content.

Affected Products

photonicgnostic Library Bookshelves plugin for WordPress
All versions from initial release through 5.11
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-09-22 - CVE-2025-57964 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57964

Vulnerability Analysis

The Library Bookshelves plugin fails to properly neutralize user-supplied input before writing it to WordPress pages generated by the plugin. Input submitted through plugin-controlled fields is stored in the database and later rendered without adequate output encoding or sanitization. Because the payload persists server-side, every visitor who loads the affected view triggers execution of the attacker's JavaScript.

Exploitation requires an authenticated user with permission to submit plugin content and a victim who interacts with the resulting page. The scope change in the CVSS vector reflects that injected scripts execute in the browser context of any user visiting the compromised page, including administrators. Successful exploitation typically leads to session cookie theft, forced administrative actions through the WordPress REST API, or delivery of secondary payloads.

Root Cause

The root cause is missing or insufficient sanitization of user input on write, combined with missing output escaping on render. WordPress provides helper functions such as sanitize_text_field(), wp_kses_post(), and esc_html() for these purposes. The vulnerable versions of library-bookshelves do not apply these controls consistently to fields that reach the DOM.

Attack Vector

An authenticated contributor-level or higher account submits crafted input through a plugin form field. The malicious markup is stored in the WordPress database as part of a bookshelf entry. When any user loads the page containing that entry, the browser parses and executes the embedded script. No additional user action beyond viewing the page is required after the initial victim interaction.

The vulnerability is described in prose only; refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-57964

Indicators of Compromise

Bookshelf entries containing <script> tags, javascript: URIs, or event-handler attributes such as onerror= and onload=
Unexpected outbound requests from browsers loading pages that render Library Bookshelves content
New or modified WordPress administrator accounts following visits by privileged users
HTML-encoded payload fragments (for example <script>) stored in plugin database tables

Detection Strategies

Query the wp_posts and plugin-specific tables for HTML tags or JavaScript keywords inside Library Bookshelves fields
Deploy a Web Application Firewall (WAF) rule that flags script markup in POST parameters targeting plugin endpoints
Enable a Content Security Policy (CSP) in report-only mode to surface script executions that violate expected origins

Monitoring Recommendations

Log and review all authenticated writes to Library Bookshelves endpoints, correlating with user role and source IP
Alert on WordPress administrator sessions that originate from unusual geolocations shortly after content edits
Monitor browser telemetry for anomalous script execution on pages served by the plugin

How to Mitigate CVE-2025-57964

Immediate Actions Required

Deactivate the Library Bookshelves plugin if a patched release is not yet available for your environment
Audit existing bookshelf entries for stored HTML or JavaScript payloads and remove any suspicious content
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Restrict plugin write permissions to trusted user roles only

Patch Information

The vulnerability affects Library Bookshelves versions up to and including 5.11. No fixed version is listed in the referenced advisory at publication time. Consult the Patchstack advisory for the latest patch status and upgrade guidance.

Workarounds

Place the plugin behind a WAF that filters HTML markup and JavaScript from request bodies bound for plugin endpoints
Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources
Limit contributor and author account creation, and require multi-factor authentication for all WordPress logins
Remove the plugin entirely if it is not business-critical

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate library-bookshelves
wp plugin status library-bookshelves