CVE-2025-30982

Vulnerability

The MyBookProgress plugin for WordPress, developed by Stormhill Media, contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. Versions from n/a through 1.0.8 are affected. The vulnerability exists in input fields that are saved and later displayed without proper sanitization, allowing arbitrary script injection.

Exploitation

An attacker with the ability to submit content (e.g., a contributor or author role) can inject malicious JavaScript into a field that is stored in the database. When an administrator or other user views the page containing the stored input, the script executes in their browser. No special network position is required beyond standard WordPress access.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or further privilege escalation if an administrator is targeted. The impact is limited to the WordPress site's user base and does not extend to the server itself.

Mitigation

The plugin has been closed and removed from the WordPress.org plugin directory as of January 16, 2025, due to a security issue [1]. No patched version is available. Users who have the plugin installed should uninstall it immediately. There is no known workaround; removal is the only safe course of action.