CVE-2025-28930 Overview
CVE-2025-28930 is a stored Cross-Site Scripting (XSS) vulnerability in the List Mixcloud WordPress plugin developed by Rodolphe MOULIN. The flaw affects all versions of list-mixcloud from an unspecified initial release through version 1.4. The plugin fails to properly neutralize user-supplied input during web page generation, allowing an authenticated attacker with low privileges to inject persistent JavaScript payloads that execute in the browser of any user visiting the affected page.
Critical Impact
An authenticated attacker can store malicious scripts within the plugin that execute in visitors' browsers, enabling session theft, redirection, and administrative account compromise through cross-context script execution.
Affected Products
- List Mixcloud WordPress plugin (list-mixcloud) versions up to and including 1.4
- WordPress sites with the plugin installed and activated
- Any user session interacting with plugin-rendered content
Discovery Timeline
- 2025-03-11 - CVE-2025-28930 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28930
Vulnerability Analysis
The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. The List Mixcloud plugin accepts input that is later rendered into HTML output without adequate sanitization or output encoding. This allows an attacker to inject arbitrary HTML and JavaScript that persists in the site's database and executes whenever a victim renders the affected view.
Because the injected payload is stored, exploitation does not require the attacker to trick the victim into clicking a crafted URL. Any visitor to the compromised page becomes a target. The attack crosses a security boundary (scope changed), meaning script executed in a low-privileged context can affect higher-privileged users such as WordPress administrators reviewing plugin output.
Root Cause
The root cause is missing or insufficient output encoding when the plugin renders user-controlled fields into HTML. Input passed through plugin configuration or content-editing surfaces is not run through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before being emitted to the page.
Attack Vector
The attack requires a network-accessible WordPress instance and an authenticated account with low privileges, such as Contributor or Author. The attacker submits a payload containing HTML script tags or event-handler attributes through a plugin input field. User interaction is required to trigger execution, typically when an administrator or site visitor loads the page rendering the stored payload. See the Patchstack Security Vulnerability Report for advisory details.
No verified public proof-of-concept code is available. The vulnerability manifests when unsanitized input reaches the plugin's rendering path, and technical exploitation follows standard stored XSS patterns for WordPress plugins.
Detection Methods for CVE-2025-28930
Indicators of Compromise
- Presence of <script>, onerror=, onload=, or javascript: strings in plugin-managed database rows tied to list-mixcloud
- Unexpected outbound HTTP requests from administrator browser sessions after viewing plugin pages
- New or modified WordPress administrator accounts created shortly after plugin content was edited by a lower-privileged user
Detection Strategies
- Inspect wp_postmeta and plugin-specific option tables for HTML markup, event handlers, or encoded script payloads within List Mixcloud fields
- Deploy Content Security Policy (CSP) reporting to capture inline script violations originating from plugin-rendered pages
- Review WordPress audit logs for content edits made by Contributor or Author roles targeting plugin configuration
Monitoring Recommendations
- Monitor administrator session activity for anomalous API calls, particularly to /wp-json/wp/v2/users and /wp-admin/admin-ajax.php
- Alert on modifications to the wp_users and wp_usermeta tables that follow plugin content interactions
- Track outbound network traffic from workstations used by WordPress administrators for connections to unfamiliar domains
How to Mitigate CVE-2025-28930
Immediate Actions Required
- Deactivate the List Mixcloud plugin on any WordPress installation running version 1.4 or earlier until a patched release is confirmed
- Audit all existing plugin content and remove any entries containing HTML tags, event handlers, or encoded scripts
- Rotate credentials for administrator accounts that accessed pages rendered by the plugin during the exposure window
Patch Information
At the time of publication, no fixed version is identified in the advisory. Consult the Patchstack Security Vulnerability Report for the current remediation status and any subsequent vendor updates.
Workarounds
- Restrict the ability to edit plugin content to trusted administrator accounts only by removing edit capabilities from Contributor and Author roles
- Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in requests targeting plugin endpoints
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress administrator pages
- Remove the plugin entirely if it is not essential to site functionality
# Disable the plugin via WP-CLI until a patched version is available
wp plugin deactivate list-mixcloud
# Remove the plugin entirely from the WordPress installation
wp plugin uninstall list-mixcloud
# Audit for stored payloads in plugin-related options
wp db query "SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%mixcloud%' AND option_value REGEXP '<script|onerror=|onload=|javascript:';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
