CVE-2025-13849: Cool YT Player WordPress XSS Vulnerability

CVE-2025-13849 Overview

The Cool YT Player plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the videoid parameter affecting all versions up to and including version 1.0. The vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code that executes whenever users access an affected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts into WordPress pages, potentially leading to session hijacking, credential theft, defacement, or malware distribution to site visitors.

Affected Products

• Cool YT Player plugin for WordPress version 1.0 and earlier
• WordPress installations using the vulnerable Cool YT Player plugin

Discovery Timeline

• 2026-01-07 - CVE-2025-13849 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13849

Vulnerability Analysis

This Stored XSS vulnerability exists within the Cool YT Player WordPress plugin's handling of the videoid parameter. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability allows attackers to store malicious payloads server-side, which are then served to any user who views the compromised page.

The attack can be executed remotely over the network and requires low privileges (Contributor-level access). No user interaction is required beyond the victim simply viewing an injected page. The vulnerability has a changed scope, meaning the impact extends beyond the vulnerable component itself, affecting the confidentiality and integrity of user sessions and data.

Root Cause

The root cause of this vulnerability lies in the youtube_video_wrapper.php file at line 58, where the videoid parameter is processed without proper sanitization or output escaping. When user-supplied input is rendered in HTML context without adequate encoding, it enables JavaScript injection attacks.

Attack Vector

The attack vector involves an authenticated user with at least Contributor-level permissions crafting a malicious payload within the videoid parameter. The payload is stored in the WordPress database and executed in victims' browsers when they access pages containing the injected content.

The vulnerability is exploited through the network, requiring authenticated access. An attacker would embed JavaScript code within the video ID field, which bypasses input validation and is rendered unsanitized in the page output. This allows execution of arbitrary scripts in the context of the victim's browser session.

For detailed technical analysis, refer to the WordPress Plugin Source Code and the Wordfence Vulnerability Intelligence Report.

Detection Methods for CVE-2025-13849

Indicators of Compromise

• Unusual JavaScript code embedded in WordPress posts or pages using the Cool YT Player shortcode
• Modified videoid parameters containing encoded script tags or event handlers
• Unexpected network requests originating from the WordPress frontend to external domains
• User reports of strange behavior or pop-ups when viewing pages with embedded YouTube players

Detection Strategies

• Review WordPress database entries for Cool YT Player content containing suspicious characters like <script>, onerror, onload, or encoded JavaScript
• Monitor web application firewall (WAF) logs for XSS payloads targeting WordPress plugin parameters
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Use WordPress security plugins to scan for known XSS patterns in post content

Monitoring Recommendations

• Enable detailed logging for WordPress content modifications, particularly for users with Contributor-level access
• Deploy browser-based XSS detection tools to identify malicious script execution on the frontend
• Monitor for anomalous user session behavior that could indicate session hijacking
• Set up alerts for plugin file modifications in the cool-yt-player directory

How to Mitigate CVE-2025-13849

Immediate Actions Required

• Audit all existing content using the Cool YT Player plugin for potentially malicious videoid values
• Consider temporarily disabling or removing the Cool YT Player plugin until a patched version is available
• Review user accounts with Contributor-level access or higher for any unauthorized or suspicious activity
• Implement a Web Application Firewall (WAF) rule to filter XSS payloads in plugin parameters

Patch Information

At the time of publication, users should monitor the WordPress Plugin Repository for updated versions of the Cool YT Player plugin that address this vulnerability. Verify that any update includes proper input sanitization and output escaping for the videoid parameter.

Workarounds

• Restrict the ability to use the Cool YT Player shortcode to trusted Administrator accounts only
• Implement server-side input validation to reject videoid values containing HTML or JavaScript
• Add Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
• Use a WordPress security plugin with XSS filtering capabilities to sanitize plugin output

# Example: Add Content Security Policy header in .htaccess
Header set Content-Security-Policy "script-src 'self' https://www.youtube.com; object-src 'none';"