CVE-2025-23767: Marmoset Viewer Stored XSS Vulnerability

CVE-2025-23767 Overview

CVE-2025-23767 is a stored Cross-Site Scripting (XSS) vulnerability in the Revoxis Marmoset Viewer WordPress plugin. The flaw affects all versions up to and including 1.9.3 and stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Authenticated attackers with low-level privileges can inject persistent JavaScript payloads that execute in the browsers of users who view the affected pages. The vulnerability requires user interaction and can cross security boundaries, enabling session theft, credential harvesting, or delivery of secondary payloads to site visitors and administrators.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session hijacking and content manipulation across WordPress sites running Marmoset Viewer 1.9.3 or earlier.

Affected Products

Revoxis Marmoset Viewer WordPress plugin
All versions from initial release through 1.9.3
WordPress installations with the plugin enabled

Discovery Timeline

2025-01-16 - CVE-2025-23767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23767

Vulnerability Analysis

The Marmoset Viewer plugin renders 3D model content within WordPress pages using shortcodes and configurable parameters. The vulnerability arises because the plugin fails to sanitize or encode user-supplied input before injecting it into the generated HTML output. Attackers with contributor-level or higher privileges can embed malicious JavaScript payloads inside plugin parameters. Those payloads persist in the WordPress database and execute whenever a visitor loads the affected page.

Because the scope is classified as changed, the injected script executes in a browser context that differs from the vulnerable component. This enables an attacker to affect resources beyond the plugin itself, including WordPress administrative sessions. Confidentiality, integrity, and availability impacts are each rated low, reflecting the constrained but tangible damage available through client-side script execution.

Root Cause

The root cause is missing output encoding when plugin-controlled attributes and content are rendered into the page. The plugin trusts input passed through its shortcode handlers and administrative fields without applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post(). This omission allows raw HTML and <script> constructs to be stored and later reflected verbatim into the DOM.

Attack Vector

Exploitation requires an authenticated account with permission to create or edit posts that use the Marmoset Viewer shortcode. The attacker inserts a payload into a vulnerable parameter, publishes the content, and waits for another user to view the page. When the victim loads the content, the browser parses the malicious markup and executes the attacker's script under the site's origin.

Refer to the Patchstack XSS Vulnerability Advisory for additional context on the affected input paths.

Detection Methods for CVE-2025-23767

Indicators of Compromise

Unexpected <script>, onerror, or onload attributes stored in wp_posts content associated with Marmoset Viewer shortcodes
Outbound browser requests from WordPress pages to unfamiliar domains after loading Marmoset Viewer content
New or modified administrator accounts created shortly after a low-privileged user edited a page containing the shortcode
Anomalous admin-ajax.php or wp-admin requests originating from visitor sessions

Detection Strategies

Query the WordPress database for post content containing Marmoset Viewer shortcodes combined with script tags, event handlers, or javascript: URIs
Deploy a web application firewall rule to flag stored payloads containing HTML control characters submitted to plugin endpoints
Review WordPress audit logs for post edits performed by contributor or author accounts that include suspicious markup

Monitoring Recommendations

Enable content-security-policy reporting to capture inline script violations on pages that embed Marmoset Viewer
Monitor browser telemetry for unexpected DOM modifications or third-party script loads on pages served by WordPress
Track privilege changes and session token issuance immediately following visits to pages containing the shortcode

How to Mitigate CVE-2025-23767

Immediate Actions Required

Audit all posts and pages that reference the Marmoset Viewer shortcode and remove suspicious markup or event handlers
Restrict contributor, author, and editor accounts to trusted users until the plugin is updated or removed
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found
Deploy a Content Security Policy that blocks inline scripts and untrusted script sources on WordPress front-end pages

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Administrators should monitor the Patchstack advisory and the plugin's WordPress.org listing for an update superseding version 1.9.3. Apply the vendor patch immediately once available.

Workarounds

Deactivate and remove the Marmoset Viewer plugin until a patched release is available
Revoke post-editing capabilities from non-trusted roles using a capability management plugin
Add server-side filtering that strips HTML control characters from Marmoset Viewer shortcode parameters
Enforce a strict Content Security Policy header to limit the impact of any injected script

bash

# Disable the plugin via WP-CLI until a patched version is released
wp plugin deactivate marmoset-viewer
wp plugin delete marmoset-viewer

# Restrict post editing capabilities for lower-privileged roles
wp cap remove contributor edit_posts
wp cap remove author publish_posts