CVE-2025-23854: Shoutcast Icecast Player Stored XSS Flaw

CVE-2025-23854 Overview

CVE-2025-23854 is a stored Cross-Site Scripting (XSS) vulnerability in the Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming WordPress plugin. The flaw affects all plugin versions up to and including 3.3. The vulnerability stems from improper neutralization of user-supplied input during web page generation, allowing an authenticated attacker with high privileges to inject persistent JavaScript payloads. Injected scripts execute in the browser of any user who loads the affected page, enabling session theft, credential harvesting, and further compromise of the WordPress site.

Critical Impact

An authenticated attacker can inject persistent scripts that execute in visitors' browsers, breaking the security boundary between the vulnerable plugin and the rest of the site.

Affected Products

• Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming.com (WordPress plugin)
• All versions from initial release through 3.3
• WordPress sites running the plugin with authenticated privileged users

Discovery Timeline

• 2025-01-16 - CVE-2025-23854 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23854

Vulnerability Analysis

The plugin fails to sanitize or encode user-controlled input before storing it and rendering it back into the generated HTML output. This classifies the flaw as stored XSS under [CWE-79]. Once an attacker submits a crafted payload through an affected plugin field, the malicious content persists in the database. The payload then executes in the browser context of any user who visits a page that renders the stored value.

Because the scope is changed (S:C in the CVSS vector), successful exploitation impacts resources beyond the vulnerable component. Injected scripts can access cookies, perform actions on behalf of the victim, modify page content, and pivot to other administrative functions within WordPress. User interaction is required, and the attacker must already hold high-privilege credentials on the target site.

Root Cause

The root cause is missing output encoding and input validation on plugin-controlled fields that accept administrator or editor input. Instead of applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before rendering, the plugin outputs the stored value directly into the DOM. This allows <script> tags and event-handler attributes to be interpreted as executable code.

Attack Vector

The attack vector is network-based and requires an authenticated session with elevated privileges. An attacker with such access submits a JavaScript payload through a vulnerable plugin configuration or content field. The payload is stored in the WordPress database and later rendered without sanitization. When a site administrator or visitor loads the affected page, the browser executes the injected script under the site's origin.

Refer to the Patchstack XSS Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23854

Indicators of Compromise

• Unexpected <script> tags, javascript: URIs, or event handlers such as onerror= and onload= stored in WordPress wp_options or wp_postmeta entries associated with the plugin.
• Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after visiting plugin-managed pages.
• New or unexpected administrator accounts created following an admin session that loaded a page rendering plugin output.

Detection Strategies

• Review database rows written by the plugin for HTML control characters and script constructs using targeted SQL queries.
• Enable and monitor WordPress audit logging for changes to plugin settings made by authenticated users.
• Deploy a Web Application Firewall (WAF) with rules that flag reflected or stored payloads containing script tags targeting plugin endpoints.

Monitoring Recommendations

• Alert on Content Security Policy (CSP) violation reports originating from pages that render the affected plugin.
• Monitor administrator browser sessions for anomalous DOM modifications and unexpected script execution.
• Track plugin version inventory across managed WordPress sites and flag any host still running version 3.3 or earlier.

How to Mitigate CVE-2025-23854

Immediate Actions Required

• Identify every WordPress site running the Shoutcast and Icecast HTML5 Web Radio Player by YesStreaming plugin and confirm the installed version.
• Restrict administrative access to trusted users and enforce multi-factor authentication for all privileged WordPress accounts.
• Audit plugin-managed database entries for injected payloads and remove any malicious content found.

Patch Information

As of the last NVD update, the vulnerability affects all versions up to and including 3.3, and no fixed version is identified in the referenced advisory. Monitor the Patchstack advisory and the WordPress plugin repository for release of a patched build, and apply it as soon as it becomes available.

Workarounds

• Deactivate and remove the plugin until a patched version is released if the radio player functionality is not essential.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Deploy virtual patching through a WordPress-aware WAF to block XSS payloads targeting the plugin's endpoints.

# Configuration example: restrict inline script execution via CSP header in Apache
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"