CVE-2025-60104: Gallery Custom Links Stored XSS Vulnerability

CVE-2025-60104 Overview

CVE-2025-60104 is a stored Cross-Site Scripting (XSS) vulnerability in the Jordy Meow Gallery Custom Links plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.5. It is classified under [CWE-79], improper neutralization of input during web page generation. An authenticated user with high privileges can inject malicious script payloads that persist in the plugin's stored data. When other users render the affected page, the browser executes the attacker's script in the victim's session context. The scope-changed CVSS vector indicates that impact extends beyond the vulnerable component to affect other parts of the WordPress site.

Critical Impact
Stored XSS enables session theft, administrative action hijacking, and delivery of secondary payloads to site visitors and administrators.

Affected Products

Jordy Meow Gallery Custom Links plugin for WordPress
All versions from initial release through 2.2.5
WordPress sites that render gallery output produced by the plugin

Discovery Timeline

2025-09-26 - CVE-2025-60104 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60104

Vulnerability Analysis

The Gallery Custom Links plugin extends WordPress galleries by attaching custom URLs to gallery images. The plugin fails to properly neutralize user-supplied input before storing it and rendering it back into web pages. An attacker with sufficient privileges to configure gallery items can inject HTML or JavaScript that persists in the site database. Every subsequent page view that renders the affected gallery executes the injected script in the visitor's browser. Because the CVSS scope is changed, script execution reaches security contexts outside the plugin itself, including the WordPress administrative interface. Successful exploitation can lead to cookie theft, forced administrative requests, arbitrary content injection, and pivot into further site compromise.

Root Cause

The root cause is missing or insufficient output encoding on plugin-controlled fields associated with gallery image links. Input passes from an authorized submission path into persistent storage without sanitization. When the plugin later emits this data into the HTML response, it does not apply context-appropriate escaping such as esc_attr() or esc_html(). The stored payload becomes part of the DOM and executes on render.

Attack Vector

Exploitation requires an authenticated user with privileges to edit gallery entries and requires a victim to load a page containing the malicious gallery output. The attacker submits a payload through the plugin's link configuration interface. The payload is stored and later served to any user who visits an affected gallery, including administrators. See the Patchstack XSS Vulnerability Report for the technical writeup.

Detection Methods for CVE-2025-60104

Indicators of Compromise

Gallery Custom Links database entries containing <script>, onerror=, onload=, or javascript: strings in link or attribute fields
Unexpected outbound requests from browsers rendering WordPress gallery pages to attacker-controlled domains
New or modified administrator accounts created shortly after an authenticated user viewed a gallery page
Unexpected plugin or theme installations following administrator gallery views

Detection Strategies

Query the WordPress wp_postmeta and plugin-specific tables for HTML event handlers or script tags in stored link fields
Inspect rendered gallery HTML for attribute values or link targets that break out of their expected context
Correlate WordPress access logs with browser telemetry to identify script execution originating from gallery pages

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes made by editors and administrators
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render galleries
Alert on privileged account activity that follows an administrative page load containing third-party gallery content

How to Mitigate CVE-2025-60104

Immediate Actions Required

Update the Gallery Custom Links plugin to a version later than 2.2.5 once the vendor publishes a fix
Audit all gallery entries created or modified by non-administrator users for suspicious HTML or JavaScript content
Rotate credentials and session tokens for any administrator who viewed a page containing untrusted gallery data
Restrict the roles permitted to create or edit gallery items to trusted users only

Patch Information

At the time of NVD publication, the advisory covers Gallery Custom Links versions through 2.2.5. Consult the Patchstack advisory for current fixed-version information and vendor patch status.

Workarounds

Deactivate the Gallery Custom Links plugin until a patched release is available
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Deploy a web application firewall rule that blocks HTML event handlers and script tags in plugin configuration requests
Limit editor and author roles to reduce the number of accounts that can inject stored payloads

bash

# Example CSP header to reduce stored XSS impact on WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"