CVE-2025-11872: WordPress Material Design Iconic Font XSS

CVE-2025-11872 Overview

CVE-2025-11872 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Material Design Iconic Font Integration plugin for WordPress. The flaw resides in the plugin's mdiconic shortcode, which fails to sanitize user-supplied attributes before rendering them. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. All plugin versions up to and including 2 are impacted. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level users can persist JavaScript payloads that execute in administrator sessions, enabling session theft, account takeover, and further site compromise.

Affected Products

Material Design Iconic Font Integration plugin for WordPress — all versions up to and including 2
WordPress sites permitting contributor-level accounts and above
Any page or post rendering the mdiconic shortcode with attacker-controlled attributes

Discovery Timeline

2025-10-22 - CVE-2025-11872 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11872

Vulnerability Analysis

The Material Design Iconic Font Integration plugin registers a WordPress shortcode named mdiconic. This shortcode accepts user-supplied attributes intended to control icon rendering behavior. The plugin concatenates those attributes directly into HTML output without applying WordPress escaping functions such as esc_attr() or esc_html().

As a result, an attacker who authors a post or page can supply attribute values containing HTML or JavaScript. When any visitor loads the page, the browser parses the injected markup and executes attacker-controlled script in the site's origin. Because the payload is persisted in the database, every visitor to the affected page is exposed.

Administrator sessions are the highest-value target. A payload executing under an administrator context can create new privileged users, modify plugin files, or exfiltrate site secrets. Full technical annotations are available in the Wordfence Vulnerability Report.

Root Cause

The root cause is missing input sanitization and output escaping in the shortcode handler defined in md-iconic-font-integration.php. Shortcode attribute values pass through to the DOM without contextual encoding, violating WordPress secure coding guidance for shortcode output.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker creates or edits a post that embeds the mdiconic shortcode with malicious attribute values. Once the post is submitted for review or published, any user rendering the page — including editors and administrators — triggers the payload.

No verified public exploit code is available. Refer to the vendor references above for shortcode handler details.

Detection Methods for CVE-2025-11872

Indicators of Compromise

Post or page content containing mdiconic shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: sequences
Unexpected creation of administrator or editor accounts shortly after content authored by contributor users
Outbound browser requests from admin sessions to unfamiliar domains after viewing a page rendering the shortcode
Modifications to WordPress options, theme files, or plugin files without a corresponding administrator login trail

Detection Strategies

Query the wp_posts table for post_content values matching %[mdiconic% and inspect attribute payloads for HTML control characters
Enable a WordPress security plugin or Web Application Firewall (WAF) rule that flags stored shortcode attributes containing script sinks
Correlate contributor content submissions with subsequent privilege-changing actions in the WordPress audit log

Monitoring Recommendations

Forward WordPress access logs and admin activity to a centralized log store for retention and analysis
Alert on new administrator account creation, plugin installation, or theme editor activity outside change windows
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on content pages

How to Mitigate CVE-2025-11872

Immediate Actions Required

Deactivate the Material Design Iconic Font Integration plugin until a patched release is confirmed by the vendor
Audit all posts and pages containing the mdiconic shortcode and remove suspicious attribute values
Restrict contributor and author role assignments to trusted users only and review recently created accounts
Rotate administrator passwords and invalidate active sessions if unexplained privileged actions are observed

Patch Information

No patched version has been published at the time of the NVD advisory. The affected code path is documented at md-iconic-font-integration.php line 46. Monitor the Wordfence advisory for release updates and apply any vendor patch as soon as it is published.

Workarounds

Remove or disable the plugin and replace it with a maintained icon integration until a fix ships
Deploy a WAF rule that blocks shortcode attribute payloads containing <, >, javascript:, or event-handler prefixes
Enforce a strict Content Security Policy that disallows inline scripts on public content pages
Downgrade contributor and author accounts, or require editor review before publishing posts that contain shortcodes

bash

# Configuration example: locate posts that use the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%[mdiconic%';"

# Deactivate the plugin via WP-CLI until a patched version is released
wp plugin deactivate material-design-iconic-font-integration