CVE-2025-27330

Vulnerability

Overview The PlayerJS plugin for WordPress suffers from a DOM-based Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions from n/a through 2.23. [1]

Exploitation

Conditions An attacker can exploit this vulnerability by tricking a privileged user into performing an action such as clicking a malicious link or visiting a crafted page. The vulnerability is often used in mass-exploit campaigns targeting thousands of websites regardless of size. [1]

Impact

Successful exploitation allows the attacker to inject arbitrary scripts, including redirects, advertisements, and other HTML payloads, which execute when any visitor accesses the affected site. This can lead to defacement, data theft, or malware distribution. [1]

Mitigation

The vendor has released version 2.24 to address the issue. Users are strongly advised to update immediately. Patchstack users can enable auto-update for vulnerable plugins. [1]