CVE-2025-9130 Overview
CVE-2025-9130 is a Stored Cross-Site Scripting (XSS) vulnerability in the Unify plugin for WordPress. The flaw affects all plugin versions up to and including 3.4.7. It exists in the unify_checkout shortcode, which fails to sanitize user-supplied attributes and escape output. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page. The issue is tracked as CWE-79 and was analyzed by Wordfence.
Critical Impact
Contributor-level users can persist malicious JavaScript in WordPress pages, enabling session hijacking, credential theft, and administrator account takeover when higher-privileged users view the compromised content.
Affected Products
- Unify plugin for WordPress, versions up to and including 3.4.7
- WordPress sites permitting contributor-level (or higher) user registration
- Any site rendering the unify_checkout shortcode with attacker-controlled attributes
Discovery Timeline
- 2025-10-03 - CVE-2025-9130 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-9130
Vulnerability Analysis
The vulnerability is a Stored Cross-Site Scripting flaw in the Unify plugin's unify_checkout shortcode handler, located in Actions/PlatformApi.php. Shortcode attributes supplied by an authenticated user are rendered into page output without adequate sanitization or escaping. Because the payload is stored in post or page content, it executes each time a visitor loads the affected page. The stored nature of the flaw magnifies its impact compared to reflected XSS, allowing persistent script execution across sessions and users. Contributor-level authentication is a low bar on sites that permit open registration or delegate content authoring. The scope-changed impact means injected scripts execute in the security context of any authenticated viewer, including administrators. See the vulnerable source in the 3.4.7 tag and the corrected code in the 3.4.8 tag.
Root Cause
The plugin does not apply WordPress escaping primitives such as esc_attr() or esc_html() to attributes passed into the unify_checkout shortcode. It also omits sanitization functions such as sanitize_text_field() on input. This absence of input validation and output escaping produces the classic [CWE-79] pattern for Stored XSS.
Attack Vector
A remote attacker authenticates to WordPress with a contributor account. The attacker creates or edits a post containing the unify_checkout shortcode with attribute values that embed JavaScript payloads. When any user, including an administrator, previews or views the post, the browser executes the attacker's script.
// No verified proof-of-concept is available.
// The vulnerability is triggered by embedding a shortcode
// such as [unify_checkout attr="<malicious JS payload>"] in
// post content, where the attribute value is rendered without
// escaping. See the Wordfence advisory for technical details.
Detection Methods for CVE-2025-9130
Indicators of Compromise
- Post or page content containing unify_checkout shortcode entries with unusual attribute values, embedded <script> tags, on* event handlers, or javascript: URIs.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading pages that use the shortcode.
- New or modified WordPress administrator accounts, or unexplained changes to user roles following contributor content submissions.
Detection Strategies
- Inventory WordPress installations and identify sites running Unify plugin versions at or below 3.4.7.
- Search the wp_posts table for unify_checkout shortcode occurrences and inspect attribute values for HTML or JavaScript tokens.
- Deploy a Web Application Firewall rule that inspects shortcode attribute values for XSS patterns before content is stored.
Monitoring Recommendations
- Monitor WordPress audit logs for post creation and edits performed by contributor-level accounts.
- Alert on newly registered contributor accounts followed by rapid content submission.
- Track browser-side Content Security Policy (CSP) violation reports for pages that render the plugin's shortcode.
How to Mitigate CVE-2025-9130
Immediate Actions Required
- Update the Unify plugin to version 3.4.8 or later on all WordPress installations.
- Audit existing posts and pages for the unify_checkout shortcode and remove any suspicious attribute payloads.
- Review contributor and author accounts, revoking access for users who do not require content authoring privileges.
- Rotate credentials and session tokens for administrators who may have viewed compromised pages.
Patch Information
The vendor addressed the vulnerability in Unify plugin version 3.4.8. Compare the vulnerable code in the 3.4.7 tag with the fix in the 3.4.8 tag. Plugin details are available on the WordPress plugin page.
Workarounds
- Disable the Unify plugin until the update to 3.4.8 can be applied.
- Restrict contributor account creation and require administrator approval for role assignments.
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendering the plugin's shortcode.
# Update the Unify plugin using WP-CLI
wp plugin update unify --version=3.4.8
# Verify the installed version
wp plugin get unify --field=version
# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%unify_checkout%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
