CVE-2025-23561: MLL Audio Player Stored XSS Vulnerability

CVE-2025-23561 Overview

CVE-2025-23561 is a stored cross-site scripting (XSS) vulnerability in the MLL Audio Player MP3 Ajax WordPress plugin developed by robertkay. The flaw affects all plugin versions up to and including 0.7. An authenticated attacker with low privileges can inject malicious script content that persists in the application and executes in the browser of any user who views the affected page. The issue is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored XSS allows attackers to hijack authenticated sessions, redirect visitors, or deliver secondary payloads through any WordPress site running a vulnerable version of the plugin.

Affected Products

MLL Audio Player MP3 Ajax plugin (music-let-loose-mp3-audio-player) versions through 0.7
WordPress installations with the vulnerable plugin activated
Any site content rendered to visitors that includes the unsanitized plugin output

Discovery Timeline

2025-02-03 - CVE-2025-23561 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23561

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the MLL Audio Player MP3 Ajax plugin. The plugin fails to properly neutralize user-supplied input before including it in generated web pages. Because the payload is persisted server-side, every subsequent page render delivers the attacker's script to viewers. Exploitation requires an authenticated user with at least contributor-level privileges and some user interaction on the victim side. The scope is changed, meaning script execution can affect resources beyond the vulnerable component, including the wider WordPress admin session context. For technical details, see the Patchstack advisory.

Root Cause

The plugin does not apply output escaping or input sanitization to fields that accept user-controlled data. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() to prevent these issues, but the affected code paths in versions up to 0.7 omit them. As a result, an attacker can supply raw HTML or JavaScript that the plugin writes directly into the DOM.

Attack Vector

An attacker authenticates to the WordPress site with a low-privilege account and submits a payload containing HTML script content through an input field exposed by the plugin. The payload is stored in the WordPress database. When an administrator, editor, or visitor renders the affected page, the browser parses and executes the script in the site's origin. Typical outcomes include session cookie theft, admin account takeover, forced administrative actions, and redirection to attacker-controlled infrastructure.

No verified exploit code is available in public sources at the time of publication. Refer to the Patchstack vulnerability report for additional technical context.

Detection Methods for CVE-2025-23561

Indicators of Compromise

Stored content in the WordPress database (wp_posts, wp_postmeta, or plugin-specific tables) containing <script>, onerror=, onload=, or javascript: sequences originating from the plugin's input fields.
Unexpected outbound requests from browsers loading pages that embed the MLL Audio Player shortcode or widget.
New or modified WordPress administrator accounts following visits to pages that render the vulnerable plugin.

Detection Strategies

Audit the WordPress database for plugin-related rows containing HTML event handlers or script tags.
Enable a web application firewall ruleset for OWASP Core Rule Set XSS categories and review triggered events targeting plugin endpoints.
Review WordPress user activity logs for unexpected content submissions from low-privilege accounts.

Monitoring Recommendations

Alert on POST requests to plugin admin-ajax handlers containing angle brackets or encoded script fragments.
Monitor for anomalous session behavior, such as administrator accounts issuing requests immediately after page loads that reference the plugin.
Track file integrity of the wp-content/plugins/music-let-loose-mp3-audio-player/ directory to identify tampering.

How to Mitigate CVE-2025-23561

Immediate Actions Required

Deactivate and remove the MLL Audio Player MP3 Ajax plugin until a patched release is confirmed available.
Audit stored plugin content and remove any entries containing script tags or event handler attributes.
Rotate credentials and session cookies for any administrator account that accessed pages rendering the plugin.

Patch Information

No fixed version is identified in the advisory. Versions through 0.7 are affected. Monitor the Patchstack advisory and the WordPress plugin repository for updates. If the plugin remains unmaintained, migrate to a supported audio player alternative.

Workarounds

Restrict contributor and author role assignments to trusted users only, reducing the pool of accounts that can submit stored payloads.
Deploy a WordPress-aware WAF with XSS protection rules in front of the site.
Enforce a strict Content Security Policy that blocks inline scripts and unknown script sources.
Disable the plugin's shortcodes on public pages until a patched version is validated.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate music-let-loose-mp3-audio-player
wp plugin delete music-let-loose-mp3-audio-player

# Search stored content for potential XSS payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"