CVE-2025-9372 Overview
CVE-2025-9372 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Ultimate Multi Design Video Carousel plugin for WordPress. The flaw affects all plugin versions up to and including 1.4. It stems from insufficient input sanitization and output escaping within plugin-handled content. Authenticated attackers with editor-level access can inject arbitrary web scripts into pages. The injected payload executes in the browser of any visitor who loads the affected page. The issue only impacts multi-site installations and single-site installations where unfiltered_html has been disabled.
Critical Impact
Editor-level attackers can persist JavaScript in rendered pages, enabling session theft, administrative action hijacking, and client-side redirection on multi-site WordPress environments.
Affected Products
- Ultimate Multi Design Video Carousel plugin for WordPress (all versions ≤ 1.4)
- WordPress multi-site installations running the affected plugin
- WordPress installations with unfiltered_html disabled
Discovery Timeline
- 2025-10-03 - CVE-2025-9372 published to NVD
- 2026-10-12 - Last updated in NVD database
Technical Details for CVE-2025-9372
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Ultimate Multi Design Video Carousel plugin. The plugin accepts user-supplied input through fields exposed to authenticated editors and persists that input into page content. When pages render, the plugin outputs the stored values without proper escaping. Browsers interpret injected <script> tags or event-handler attributes as executable code. The malicious payload fires every time a user loads the affected page. Because the script runs in the context of the WordPress site, it can access cookies, perform authenticated requests, and manipulate the DOM. The vulnerability is scoped as changed, meaning the injected code affects users beyond the attacker's own privilege boundary.
Root Cause
The plugin fails to sanitize incoming data on write and does not escape output on render. WordPress normally restricts raw HTML authoring to users with the unfiltered_html capability. In multi-site deployments, that capability is stripped from editors by default. Administrators of hardened single-site installations also remove it. The plugin does not reapply equivalent filtering, so editors who should not be able to post raw HTML gain that ability through plugin-specific fields.
Attack Vector
An attacker must authenticate with editor-level privileges or higher. The attacker submits a crafted payload containing JavaScript through the plugin's input fields on a vulnerable page or post. WordPress stores the payload in the database. On subsequent page views, the plugin emits the raw payload inside page markup. Any visitor, including administrators, triggers the script. Payloads can harvest session cookies, submit requests to privileged administrative endpoints, or inject secondary content such as cryptocurrency miners or redirect chains. Review the Wordfence Vulnerability Intelligence advisory for additional technical context.
Detection Methods for CVE-2025-9372
Indicators of Compromise
- Unexpected <script> tags, onerror, onload, or javascript: URIs stored in wp_posts content or plugin-specific meta rows
- Outbound requests from site visitors to unfamiliar domains after loading pages that embed the video carousel
- New or modified administrator accounts created shortly after editor logins
- Browser console errors referencing third-party domains injected into carousel markup
Detection Strategies
- Query the WordPress database for stored carousel configuration values containing <script, onerror=, or javascript: substrings
- Monitor Web Application Firewall (WAF) logs for POST requests to plugin edit endpoints containing HTML or JavaScript payloads
- Compare the installed plugin version against the fixed release in wp-content/plugins/ultimate-multi-design-video-carousel/
- Enable file integrity monitoring for the plugin directory to detect tampering
Monitoring Recommendations
- Review editor-role activity logs for anomalous page edits that inject HTML into carousel fields
- Alert on authenticated POST requests to admin endpoints originating from editor accounts outside normal working hours
- Deploy Content Security Policy (CSP) reporting to surface inline script execution attempts on public pages
How to Mitigate CVE-2025-9372
Immediate Actions Required
- Audit all pages and posts containing the Ultimate Multi Design Video Carousel shortcode or block for injected scripts
- Rotate credentials for any editor-level account showing suspicious activity and invalidate active WordPress sessions
- Restrict editor-role assignments and apply the principle of least privilege for content contributors
- Deploy a WAF rule that blocks HTML tags in plugin-specific input parameters
Patch Information
No fixed version is referenced in the available CVE data. Monitor the plugin page on WordPress.org and the Wordfence Vulnerability Intelligence entry for patch availability and apply the vendor update as soon as it is published.
Workarounds
- Deactivate and remove the Ultimate Multi Design Video Carousel plugin until a patched release is available
- Temporarily remove the editor role from untrusted users or downgrade to the author role
- Enforce a strict Content Security Policy that disallows inline scripts on front-end pages
- Place the site behind a WAF with managed rules for WordPress stored XSS payloads
# Example Content Security Policy header (adjust sources to your environment)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
