CVE-2025-9129: WordPress Flexi Plugin XSS Vulnerability

CVE-2025-9129 Overview

CVE-2025-9129 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Flexi plugin for WordPress. The flaw resides in the flexi-form-tag shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor rendering an affected page. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can inject persistent JavaScript into WordPress pages, enabling session hijacking, credential theft, and administrative account takeover when higher-privileged users view the compromised content.

Affected Products

Flexi plugin for WordPress, all versions through 4.28
WordPress sites permitting contributor-level or higher user registration
Any WordPress deployment rendering flexi-form-tag shortcode content

Discovery Timeline

2025-10-03 - CVE-2025-9129 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9129

Vulnerability Analysis

The Flexi plugin exposes the flexi-form-tag shortcode for embedding form elements into WordPress pages and posts. The shortcode handler accepts user-supplied attributes and renders them into the page output without applying sanitization or escaping functions. This turns the shortcode into a persistent injection sink accessible to any user permitted to author content.

Because the payload is stored in the database and rendered every time the containing page loads, the attack is persistent and affects every subsequent visitor. Injected scripts execute in the browser context of the victim, inheriting their session cookies, WordPress nonces, and REST API access. When an administrator views the compromised page, the attacker can pivot to full site takeover by creating new administrative accounts or installing malicious plugins.

The attack requires only contributor-level credentials, a low bar for sites that allow open registration, guest posting, or community contributions. Exploitation is scoped beyond the vulnerable component because injected script runs within the trusted origin of the WordPress site.

Root Cause

The root cause is missing input sanitization and output escaping in the flexi-form-tag shortcode handler within class-flexi-form.php. WordPress provides functions such as sanitize_text_field(), esc_attr(), and esc_html() for exactly this purpose, but the plugin renders shortcode attributes directly into HTML output. See the WordPress Plugin Code Review for the affected code path.

Attack Vector

An authenticated attacker with contributor privileges creates or edits a post containing the flexi-form-tag shortcode with a malicious attribute value. The attribute contains JavaScript delivered via an HTML event handler or <script> fragment. When the post is published or previewed by an editor, administrator, or site visitor, the browser parses and executes the injected script.

Refer to the Wordfence Vulnerability Report for additional technical context. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2025-9129

Indicators of Compromise

Post or page content containing [flexi-form-tag] shortcodes with unusual attribute values such as inline event handlers (onerror, onload) or encoded script fragments
Unexpected administrator, editor, or user account creation shortly after contributors publish content
Outbound requests from visitor browsers to attacker-controlled domains loading remote JavaScript
Modification of wp_options, theme files, or plugin files following views of contributor-authored pages

Detection Strategies

Audit the wp_posts table for shortcode attributes containing <script>, javascript:, on*= handlers, or base64-encoded payloads
Review WordPress user registration and role-change logs for anomalies correlated with contributor activity
Deploy a web application firewall rule that inspects POST bodies to wp-admin/post.php for XSS patterns within shortcode attributes

Monitoring Recommendations

Enable WordPress activity logging plugins to record post edits, user role changes, and plugin installations
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages authored by contributors
Alert on new contributor account registrations followed by rapid post creation containing shortcodes

How to Mitigate CVE-2025-9129

Immediate Actions Required

Deactivate the Flexi plugin until a patched version above 4.28 is confirmed available and installed
Restrict contributor-level access and audit existing contributor accounts for legitimacy
Review all posts containing the flexi-form-tag shortcode and remove suspicious attribute values
Rotate credentials for any administrator or editor who previewed contributor-authored content since the plugin was installed

Patch Information

As of the last NVD update on 2026-06-17, the vulnerability affects all versions of the Flexi plugin up to and including 4.28. Consult the Flexi Plugin Developer Info page for the latest release information and apply any vendor-published fix promptly.

Workarounds

Remove or disable the Flexi plugin from WordPress installations that cannot immediately patch
Enforce a strict Content Security Policy that disallows inline script execution to blunt XSS payloads
Limit user roles capable of publishing content to trusted authors and editors only
Require review and approval of all contributor submissions before publication

bash

# Disable the Flexi plugin via WP-CLI as an interim mitigation
wp plugin deactivate flexi

# Search the database for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%flexi-form-tag%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror=%');"