CVE-2025-11801 Overview
The AudioTube plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the caption attribute of the audiotube shortcode. The flaw affects all plugin versions up to and including 0.0.3. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handler at index.php line 64. This issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can inject persistent scripts that execute in the browser context of any visitor, enabling session theft, administrative action forgery, and site defacement.
Affected Products
- AudioTube plugin for WordPress, versions up to and including 0.0.3
- WordPress sites permitting contributor-level or higher account registration
- Any site using the [audiotube] shortcode with the caption attribute
Discovery Timeline
- 2025-11-21 - CVE-2025-11801 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11801
Vulnerability Analysis
The AudioTube plugin registers an audiotube shortcode that accepts a caption attribute for display alongside embedded audio content. The plugin renders the attribute value into page HTML without applying WordPress escaping functions such as esc_attr() or esc_html(). A contributor who submits a post containing a crafted shortcode payload persists arbitrary markup into the database. When an editor, administrator, or site visitor later loads the page, the browser parses and executes the injected script in the site's origin.
Because the payload runs in the context of a privileged user's session, the attacker can extend impact well beyond the contributor role. Common outcomes include stealing authentication cookies, issuing REST API requests to create new administrator accounts, and pivoting to plugin or theme installation.
Root Cause
The root cause is missing output escaping in the shortcode rendering path at plugins/audiotube/index.php line 64. The plugin concatenates the caption attribute directly into the HTML output rather than passing it through WordPress escaping APIs. See the WordPress Plugin Code Reference for the vulnerable code location.
Attack Vector
Exploitation requires an authenticated account with contributor privileges or higher. The attacker creates or edits a post containing an audiotube shortcode where the caption attribute holds a JavaScript payload wrapped in an HTML event handler or <script> tag. Once the post is previewed or published and viewed by another user, the payload executes. No user interaction beyond page navigation is required by the victim.
Refer to the Wordfence Vulnerability Report for additional exploitation context.
Detection Methods for CVE-2025-11801
Indicators of Compromise
- Posts or pages containing [audiotube ... caption="..."] shortcodes with HTML tags, event handlers such as onerror= or onload=, or <script> fragments inside the caption value.
- Unexpected new administrator accounts, modified user roles, or newly installed plugins following contributor activity.
- Outbound requests from visitor browsers to attacker-controlled domains sourced from WordPress pages rendering the shortcode.
Detection Strategies
- Query the wp_posts table for post_content matching the audiotube shortcode combined with suspicious characters such as <, >, or javascript: in the caption attribute.
- Review audit logs for contributor accounts that submitted or edited posts referencing the AudioTube shortcode.
- Inspect rendered page HTML for unescaped script content within elements adjacent to AudioTube audio embeds.
Monitoring Recommendations
- Enable a web application firewall with rules for stored XSS patterns in POST bodies targeting /wp-admin/post.php and the REST API endpoint /wp-json/wp/v2/posts.
- Log and alert on administrator account creation, role changes, and plugin installation events within short time windows of contributor post submissions.
- Monitor browser telemetry or content security policy reports for script-src violations originating from published pages.
How to Mitigate CVE-2025-11801
Immediate Actions Required
- Deactivate and remove the AudioTube plugin until a patched version above 0.0.3 is published by the maintainer.
- Audit all existing posts and pages for the audiotube shortcode and remove or sanitize any suspicious caption values.
- Review contributor and author accounts, revoking access for any unverified or dormant users.
- Rotate credentials and session tokens for administrator accounts that may have viewed compromised pages.
Patch Information
No fixed version is listed in the NVD entry at time of publication. All releases up to and including 0.0.3 are vulnerable. Monitor the WordPress plugin repository for an updated release that adds esc_attr() or equivalent escaping to the caption attribute.
Workarounds
- Restrict contributor and author registration on public-facing WordPress sites where the plugin remains active.
- Deploy a Content Security Policy that disallows inline script execution to blunt the impact of injected payloads.
- Configure WordPress role capabilities to prevent contributors from using shortcodes, or filter the audiotube shortcode output through a custom escaping wrapper.
# Disable and remove the vulnerable plugin via WP-CLI
wp plugin deactivate audiotube
wp plugin uninstall audiotube
# Audit database for suspicious caption payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[audiotube%caption=%<%'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
