CVE-2025-5235 Overview
CVE-2025-5235 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the OpenSheetMusicDisplay plugin for WordPress. The flaw exists in all versions up to and including 1.4.0 and stems from insufficient input sanitization and output escaping of the className parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can persist malicious JavaScript into WordPress pages, enabling session theft, administrative account takeover, and drive-by delivery of secondary payloads to site visitors.
Affected Products
- OpenSheetMusicDisplay WordPress plugin versions ≤ 1.4.0
- WordPress installations with Contributor-level or higher accounts
- Any site serving pages that embed the plugin shortcode
Discovery Timeline
- 2025-05-30 - CVE-2025-5235 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5235
Vulnerability Analysis
The OpenSheetMusicDisplay plugin exposes a shortcode that accepts a className parameter used to set CSS classes on the rendered sheet music container. The plugin writes this parameter directly into HTML output without applying WordPress escaping functions such as esc_attr() or sanitize_html_class(). An attacker with Contributor privileges can craft a shortcode where the className value breaks out of the attribute context and injects a <script> tag or event handler. Because the payload is stored in post content, execution occurs every time a reviewer, editor, administrator, or site visitor loads the page. This transforms a low-privileged authoring role into a foothold for account takeover.
Root Cause
The root cause is missing input sanitization on the className shortcode attribute in opensheetmusicdisplay.php combined with the absence of output escaping when the attribute is emitted into the HTML response. The vulnerable code path is referenced in the WordPress plugin source. WordPress provides esc_attr() and wp_kses() for exactly this scenario, but neither was applied before the 1.4.1 release.
Attack Vector
Exploitation requires an authenticated session with Contributor-level access or above. The attacker submits a post or page containing the OpenSheetMusicDisplay shortcode with a malicious className value that closes the surrounding attribute quote and appends a script payload or DOM event handler. The Contributor role does not require moderator approval to store the content in the database. When a higher-privileged user previews or publishes the post, or when the page is served to public visitors, the JavaScript executes in their browser context and can perform actions such as creating administrator accounts, exfiltrating session cookies, or serving malicious downloads. User interaction is required, and the scope change reflects the ability to affect other users beyond the attacker's own session.
See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-5235
Indicators of Compromise
- Post or page content containing OpenSheetMusicDisplay shortcodes with className values that include quotes, angle brackets, javascript:, on* event handlers, or <script> tags
- New WordPress administrator accounts created shortly after a Contributor submitted or edited content
- Unexpected outbound requests from browsers rendering pages that embed the plugin
- Modifications to wp_posts entries by Contributor-level accounts referencing the plugin shortcode
Detection Strategies
- Query the wp_posts table for post_content containing the OpenSheetMusicDisplay shortcode and inspect any className attribute for HTML metacharacters
- Review web server access logs for POST requests to wp-admin/post.php from Contributor accounts followed by anomalous admin activity
- Deploy a web application firewall rule that flags shortcode parameters containing script tags or JavaScript event handlers
Monitoring Recommendations
- Alert on WordPress role changes and new administrator account creation events
- Monitor Content Security Policy violation reports for inline script executions on pages hosting the plugin
- Track plugin version inventory across WordPress deployments to identify hosts still running versions ≤ 1.4.0
How to Mitigate CVE-2025-5235
Immediate Actions Required
- Update the OpenSheetMusicDisplay plugin to the version released in WordPress Changeset #3301757, which is above 1.4.0
- Audit all Contributor, Author, and Editor accounts and revoke access for unknown or dormant users
- Review recent posts and pages that use the plugin shortcode and remove any suspicious className values
Patch Information
The maintainers addressed the vulnerability in the plugin update tracked by WordPress Changeset #3301757. The patch adds sanitization and escaping to the className shortcode attribute. Administrators should apply the update through the WordPress plugin manager or by pulling the latest release from the WordPress plugin repository. See the GitHub CHANGELOG for upstream release notes.
Workarounds
- Restrict Contributor and higher roles to trusted users only until the patched version is deployed
- Deactivate the OpenSheetMusicDisplay plugin on sites where an immediate update is not possible
- Deploy a Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads
- Configure a web application firewall to block shortcode payloads containing HTML metacharacters in the className parameter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
