CVE-2025-11825: WordPress Playerzbr Plugin XSS Vulnerability

CVE-2025-11825 Overview

CVE-2025-11825 is a Stored Cross-Site Scripting (XSS) vulnerability in the Playerzbr plugin for WordPress. The flaw affects all plugin versions up to and including 1.6. It resides in the handling of the urlmeta post meta field, where the plugin fails to properly sanitize input and escape output.

Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. This vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Stored XSS enables session hijacking, credential theft, and unauthorized administrative actions when a privileged user views a compromised page.

Affected Products

Playerzbr plugin for WordPress, versions up to and including 1.6
WordPress sites permitting contributor-level or higher accounts
Any site using the plugin's urlmeta post meta functionality

Discovery Timeline

2025-10-22 - CVE-2025-11825 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11825

Vulnerability Analysis

The vulnerability exists in the Playerzbr plugin's processing of the urlmeta post meta field. The plugin accepts user-supplied values and stores them without sufficient sanitization. When the value is later rendered, the plugin fails to escape output, allowing HTML and JavaScript to execute in the browser context.

Because the payload is persisted in the database, every subsequent visitor who loads the affected page triggers execution. This differentiates stored XSS from reflected variants and increases the attack surface significantly. Administrators viewing content submitted by contributors are prime targets, since script execution occurs with their session context.

Relevant plugin source appears at Playerzbr plugin.php line 193 and Playerzbr plugin.php line 229, where the meta field is handled. Additional context is documented in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on read for the urlmeta post meta field. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() that must be applied appropriately, but the plugin fails to invoke them for this field.

Attack Vector

An authenticated attacker holding a contributor role or higher submits a post containing a malicious payload in the urlmeta field. The payload is stored in the WordPress postmeta table. When any user renders the affected post or page, the unescaped value is emitted into the HTML response and executed by the browser. The changed-scope indicator reflects the ability of the injected script to affect users beyond the attacker, including administrators reviewing contributor content.

No verified public proof-of-concept exploit code has been published for this issue. Refer to the linked Wordfence advisory for technical details.

Detection Methods for CVE-2025-11825

Indicators of Compromise

Post meta records where urlmeta values contain <script>, javascript:, onerror=, onload=, or other event handler substrings
Unexpected outbound network requests originating from browser sessions of administrators after viewing contributor-authored pages
New or modified administrative users, plugin installations, or theme changes following an XSS payload trigger

Detection Strategies

Query the wp_postmeta table for meta_key = 'urlmeta' and inspect values for HTML tags or JavaScript scheme prefixes
Review WordPress access logs for POST requests to post.php or post-new.php by contributor accounts that include suspicious payloads in form fields
Enable Content Security Policy (CSP) reporting to identify inline script violations on pages rendered from Playerzbr content

Monitoring Recommendations

Monitor creation and modification of contributor-level and above accounts, particularly self-registration events
Alert on WordPress option or user table changes occurring during administrative page rendering sessions
Track plugin usage inventory to identify sites still running Playerzbr versions 1.6 or earlier

How to Mitigate CVE-2025-11825

Immediate Actions Required

Deactivate the Playerzbr plugin until a patched version is available or replace it with a maintained alternative
Audit existing posts and wp_postmeta entries for the urlmeta key and remove or sanitize any values containing script content
Review contributor, author, and editor accounts for legitimacy and rotate credentials for any suspicious accounts

Patch Information

At the time of the last NVD update, no fixed version had been published for the Playerzbr plugin. Site administrators should monitor the Wordfence advisory and the WordPress plugin repository for release of a patched version above 1.6.

Workarounds

Restrict contributor and author registration to trusted users only and disable open registration where possible
Deploy a Web Application Firewall (WAF) rule to block HTML tags and JavaScript event handlers in urlmeta POST parameters
Apply a strict Content Security Policy that disallows inline scripts, reducing the impact of stored XSS payloads
Remove the plugin entirely if the affected functionality is not essential

bash

# Example: Identify posts containing suspicious urlmeta values via WP-CLI
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = 'urlmeta' \
  AND (meta_value LIKE '%<script%' \
       OR meta_value LIKE '%javascript:%' \
       OR meta_value LIKE '%onerror=%');"