CVE-2025-8064 in Bible SuperSearch Plugin
Summary
by MITRE • 08/21/2025
The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selector_height’ parameter in all versions up to, and including, 6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2025
The vulnerability identified as CVE-2025-8064 affects the Bible SuperSearch plugin for WordPress, specifically targeting versions up to and including 6.0.1. This represents a critical security flaw that undermines the integrity of WordPress installations by enabling malicious actors with Contributor-level privileges or higher to execute persistent cross-site scripting attacks. The vulnerability resides within the plugin's handling of the 'selector_height' parameter, which fails to properly sanitize user inputs before processing and rendering them in web pages. The lack of adequate input validation and output escaping creates an exploitable condition that allows attackers to inject malicious scripts that persist across user sessions.
The technical nature of this vulnerability aligns with CWE-79, which defines Cross-Site Scripting as a common weakness in web applications where untrusted data is improperly incorporated into web pages without proper validation or escaping. This flaw specifically manifests as a stored XSS vulnerability because the malicious scripts are saved to the server and executed whenever affected pages are accessed by other users. The attack vector requires an authenticated user with Contributor privileges or higher, which represents a significant concern as it allows attackers to leverage existing user access rather than requiring initial exploitation through external means. The 'selector_height' parameter serves as the entry point for injecting malicious code that can be executed in the context of other users' browsers.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with the capability to perform various malicious activities including session hijacking, data theft, and redirection to malicious websites. Since the vulnerability affects pages that will execute the injected scripts whenever any user accesses them, the potential attack surface is broad and can affect multiple users within the WordPress installation. The stored nature of the vulnerability means that even if the initial attack occurs during a specific session, the malicious code will persist and execute for any user who visits the affected pages, creating a long-term security risk. This characteristic makes the vulnerability particularly dangerous for collaborative environments where multiple users regularly access shared content.
Mitigation strategies for CVE-2025-8064 should prioritize immediate plugin updates to versions that address the input sanitization and output escaping deficiencies. Organizations should implement strict access controls and privilege management to limit the number of users with Contributor-level access or higher, as this reduces the attack surface for potential exploitation. The implementation of Content Security Policy headers can provide additional protection against script execution, though this should complement rather than replace proper input validation. Security monitoring should include regular checks for unauthorized modifications to plugin files and database entries that might indicate exploitation attempts. Additionally, administrators should conduct thorough security audits of all installed plugins to identify similar vulnerabilities and ensure that proper sanitization and escaping mechanisms are in place for all user-provided inputs. The vulnerability also highlights the importance of following secure coding practices such as those outlined in the OWASP Secure Coding Practices and aligns with ATT&CK technique T1059.001 for command and scripting interpreter execution through web-based attacks.