CVE-2025-8566: GutenBee WordPress Plugin XSS Vulnerability

CVE-2025-8566 Overview

CVE-2025-8566 is a Stored Cross-Site Scripting (XSS) vulnerability in the GutenBee – Gutenberg Blocks plugin for WordPress. The flaw affects all versions up to and including 2.18.0. It stems from insufficient input sanitization and output escaping in parameters within the CountUp and Google Maps Blocks. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, or actions performed on behalf of the victim. The vulnerability is tracked under CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute for every visitor, including administrators, enabling account takeover and site compromise.

Affected Products

GutenBee – Gutenberg Blocks plugin for WordPress
All versions up to and including 2.18.0
WordPress sites permitting Contributor-level accounts or higher

Discovery Timeline

2025-09-30 - CVE-2025-8566 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8566

Vulnerability Analysis

The GutenBee plugin extends the WordPress Gutenberg block editor with additional block types, including CountUp and Google Maps. Parameters passed to these blocks are rendered into the page output without adequate sanitization or contextual escaping. An authenticated user who can edit posts, such as a Contributor, can craft block attributes containing HTML or JavaScript payloads. When those attributes are saved and later rendered on the front end or in the editor, the browser interprets the payload as executable script.

Because the payload is stored server-side, the attack persists across sessions and affects every user who loads the compromised page. Under the CVSS scoping metric, the impact crosses the trust boundary from a limited-privilege author to unauthenticated readers and higher-privileged administrators.

Root Cause

The root cause is missing sanitization on input and missing escaping on output for user-controllable block parameters. WordPress provides functions such as wp_kses, esc_attr, esc_html, and esc_url for context-aware escaping. The GutenBee CountUp and Google Maps blocks did not apply these consistently to attributes before echoing them into HTML attributes, inline styles, or script contexts.

Attack Vector

Exploitation requires an authenticated account with Contributor role or higher. The attacker inserts a CountUp or Google Maps block into a post and supplies malicious content in a vulnerable parameter. After submission, the block is stored in the WordPress database. When any visitor renders the page, the payload executes in the visitor's browser under the origin of the WordPress site. This can be used to steal authentication cookies, invoke administrative REST API endpoints, or plant additional malicious content. No user interaction beyond loading the page is required, and the attack is repeatable across visits.

See the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for further technical detail.

Detection Methods for CVE-2025-8566

Indicators of Compromise

Post content or block attributes containing <script>, onerror=, onload=, or javascript: strings inside GutenBee CountUp or Google Maps block markup.
Unexpected outbound requests from browsers loading WordPress pages, especially to attacker-controlled domains.
New administrator accounts or role changes shortly after a Contributor-authored post is published.
Modified wp_posts rows referencing wp:gutenbee/countup or wp:gutenbee/google-maps with unusual attribute values.

Detection Strategies

Query the WordPress database for post_content containing GutenBee block markers alongside script-related tokens.
Review plugin version metadata across managed WordPress sites to identify GutenBee installations at 2.18.0 or earlier.
Correlate Contributor-level publishing events with subsequent anomalous admin-session activity in web server access logs.

Monitoring Recommendations

Enable and centralize WordPress audit logging for post creation, revision, and role change events.
Deploy a web application firewall (WAF) with rules that flag script-like content submitted through the block editor REST API (/wp-json/wp/v2/posts).
Monitor Content Security Policy (CSP) violation reports to surface unexpected inline script execution on public pages.

How to Mitigate CVE-2025-8566

Immediate Actions Required

Update the GutenBee – Gutenberg Blocks plugin to a version newer than 2.18.0 that includes the fix referenced in the WordPress plugin changeset.
Audit all existing posts using CountUp or Google Maps blocks for injected script content and remove or sanitize any suspicious entries.
Review Contributor and Author accounts, rotate credentials, and remove untrusted users.

Patch Information

The vendor addressed the issue in a subsequent GutenBee release. The relevant code change is documented in the WordPress Plugin Changeset. Administrators should install the latest version from the GutenBee WordPress Plugin Page through the WordPress plugin manager or via WP-CLI.

Workarounds

Restrict Contributor and Author role assignments to trusted users only until the plugin is updated.
Temporarily deactivate the GutenBee plugin if CountUp and Google Maps blocks are not required.
Enforce a strict Content Security Policy that disallows inline scripts and unknown external script sources.
Require administrator review and approval of all Contributor-submitted posts before publication.

bash

# Update GutenBee via WP-CLI
wp plugin update gutenbee

# Verify installed version
wp plugin get gutenbee --field=version

# Search stored posts for suspicious payloads in GutenBee blocks
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%wp:gutenbee/countup%' \
     OR post_content LIKE '%wp:gutenbee/google-maps%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"