CVE-2025-57974: TZ PlusGallery Stored XSS Vulnerability

CVE-2025-57974 Overview

CVE-2025-57974 is a stored Cross-Site Scripting (XSS) vulnerability in the TZ PlusGallery WordPress plugin developed by tuyennv. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. The vulnerability affects all versions of TZ PlusGallery up to and including 1.5.5. An authenticated attacker with high privileges can inject malicious JavaScript that persists in the database and executes in the browsers of users who view the affected pages.

Critical Impact

Attackers with high privileges can inject persistent JavaScript payloads that execute across administrative and user sessions, enabling session theft, unauthorized actions, and cross-site scope changes.

Affected Products

• TZ PlusGallery WordPress plugin versions through 1.5.5
• WordPress installations using the tuyennv tz-plus-gallery plugin
• Sites where administrators or contributors have plugin write access

Discovery Timeline

• 2025-09-22 - CVE-2025-57974 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57974

Vulnerability Analysis

The TZ PlusGallery plugin fails to sanitize user input before storing it and rendering it in generated web pages. When an authenticated user submits content through vulnerable plugin fields, the input is written to the database without proper encoding or filtering. On subsequent page rendering, the payload is emitted directly into the HTML response context, causing the browser to execute injected JavaScript.

Because the payload persists server-side, every visitor to the affected page becomes a target. The vulnerability requires user interaction to trigger and operates across a security scope boundary, meaning injected script can affect components beyond the initially vulnerable one.

Root Cause

The root cause is missing output encoding and input validation in the plugin's gallery rendering paths. WordPress provides sanitization helpers such as esc_html(), esc_attr(), and wp_kses() for handling untrusted data, but the plugin does not apply them consistently on the vulnerable fields through version 1.5.5.

Attack Vector

Exploitation requires an authenticated account with high privileges on the target WordPress site. The attacker submits a gallery item or configuration value containing an XSS payload. When another user, typically an administrator, loads the page containing the stored content, the payload executes in that user's session context. Refer to the PatchStack XSS Vulnerability Report for additional technical detail.

No public proof-of-concept exploit or exploitation in the wild has been reported at the time of publication.

Detection Methods for CVE-2025-57974

Indicators of Compromise

• Unexpected <script> tags, event handlers, or javascript: URIs stored in gallery-related database tables
• Administrator sessions performing unusual actions such as new user creation or plugin installation without operator initiation
• Outbound browser requests from admin sessions to unfamiliar external domains after visiting gallery pages

Detection Strategies

• Audit the wp_posts, wp_postmeta, and plugin-specific tables for HTML or JavaScript content in fields that should hold plain text
• Deploy a web application firewall rule set that inspects POST parameters to TZ PlusGallery endpoints for script tags and encoded payloads
• Enable Content Security Policy (CSP) reporting to surface unauthorized inline script execution on admin pages

Monitoring Recommendations

• Monitor WordPress audit logs for changes made by high-privileged accounts to gallery items
• Alert on new administrator accounts, role changes, or plugin modifications following gallery page views
• Track browser-side errors and CSP violation reports from /wp-admin/ sessions

How to Mitigate CVE-2025-57974

Immediate Actions Required

• Identify all WordPress sites running the TZ PlusGallery plugin and inventory installed versions
• Restrict high-privileged account access to trusted administrators and enforce multi-factor authentication
• Review recent gallery content for injected scripts and remove any suspicious entries

Patch Information

At the time of NVD publication, no fixed version was listed. Monitor the PatchStack advisory and the plugin's WordPress.org page for an updated release. Apply the vendor patch as soon as it becomes available.

Workarounds

• Deactivate and remove the TZ PlusGallery plugin until a patched version is released
• Deploy a Content Security Policy that disallows inline scripts on WordPress admin pages
• Use a WAF ruleset that blocks stored XSS payloads targeting WordPress plugin endpoints

# Example Content Security Policy header for WordPress admin
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"