CVE-2025-23946: Enhanced YouTube Shortcode XSS Vulnerability

CVE-2025-23946 Overview

CVE-2025-23946 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Le-Pixel-Solitaire Enhanced YouTube Shortcode plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.1. Authenticated attackers with low-level privileges can inject malicious scripts that persist in the site database and execute in the browsers of visitors and administrators. Exploitation requires user interaction and can affect resources beyond the vulnerable component's security scope.

Critical Impact
Attackers with contributor-level access can store JavaScript payloads that execute against site visitors and administrators, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

Le-Pixel-Solitaire Enhanced YouTube Shortcode plugin for WordPress
All versions from n/a through 2.0.1
WordPress installations using the enhanced-youtube-shortcode plugin

Discovery Timeline

2025-01-16 - CVE-2025-23946 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23946

Vulnerability Analysis

The Enhanced YouTube Shortcode plugin fails to properly neutralize user-supplied input before rendering it inside generated web pages. Input passed through the plugin's shortcode parameters is stored in the WordPress database without adequate sanitization or output encoding. When the shortcode renders on a page, the browser interprets the stored payload as executable script content.

Because the injected script executes in the security context of the WordPress site, attackers can perform actions on behalf of any user who views the affected page. The vulnerability crosses a security scope boundary, meaning a low-privileged contributor can impact administrators and unauthenticated visitors.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin does not apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() to shortcode attributes or user-controlled content before echoing it into the DOM. Stored payloads remain persistent across sessions and page loads.

Attack Vector

An authenticated attacker with post-authoring privileges submits content containing the vulnerable shortcode with a malicious attribute value. When any user, including administrators, visits a page rendering that shortcode, the payload executes. Typical exploitation goals include stealing session cookies, forcing administrative actions through the WordPress REST API, or redirecting visitors to attacker-controlled infrastructure.

Refer to the Patchstack XSS Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-23946

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers such as onerror/onload stored in wp_posts content
Shortcode instances of [youtube] or related plugin shortcodes containing HTML entities, encoded characters, or unusual attribute values
New or modified WordPress administrator accounts created shortly after content changes by lower-privileged users
Outbound requests from browsers visiting the site to unfamiliar third-party domains

Detection Strategies

Query the WordPress database for shortcode attributes containing angle brackets, quotes, or script keywords
Review recent posts and revisions authored by contributor or author accounts for unusual embedded content
Inspect rendered pages using automated crawlers that flag inline scripts originating from post content
Correlate content-management events with subsequent privilege changes in WordPress audit logs

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with XSS payload signatures in front of the WordPress site
Log and alert on plugin file modifications and unexpected changes to published posts
Monitor browser Content Security Policy (CSP) violation reports for blocked inline script execution

How to Mitigate CVE-2025-23946

Immediate Actions Required

Deactivate the Enhanced YouTube Shortcode plugin until a patched release is confirmed available
Audit all posts and pages containing the plugin's shortcodes and remove any suspicious attribute content
Rotate WordPress administrator passwords and invalidate active sessions if injection is suspected
Restrict contributor and author account creation and review recent role assignments

Patch Information

At the time of publication, the vendor advisory listed in the Patchstack report indicates the vulnerability affects versions up to and including 2.0.1. Administrators should monitor the plugin repository for a fixed release and apply updates immediately when available.

Workarounds

Remove the plugin entirely and replace the functionality with WordPress's native YouTube oEmbed support
Deploy a WAF rule that blocks requests containing script tags or JavaScript event handlers in shortcode parameters
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored payloads
Restrict content-submission privileges to trusted users only until a patch is verified

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate enhanced-youtube-shortcode
wp plugin delete enhanced-youtube-shortcode

# Audit posts for suspicious shortcode payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%enhanced-youtube%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"