CVE-2025-9851: WordPress Appointmind Plugin XSS Vulnerability

CVE-2025-9851 Overview

CVE-2025-9851 is a Stored Cross-Site Scripting (XSS) vulnerability in the Appointmind plugin for WordPress. The flaw affects all versions up to and including 4.1.0. It resides in the plugin's appointmind_calendar shortcode, which fails to properly sanitize user-supplied attributes and escape output. Authenticated users with contributor-level permissions or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views the affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that run against site visitors and administrators, enabling session theft, admin takeover, or malicious redirects.

Affected Products

Appointmind plugin for WordPress, versions <= 4.1.0
Any WordPress site allowing contributor-level registration with the plugin active
Sites embedding the appointmind_calendar shortcode in published content

Discovery Timeline

2025-09-17 - CVE-2025-9851 published to the National Vulnerability Database (NVD)
2026-06-17 - Entry last modified in NVD

Technical Details for CVE-2025-9851

Vulnerability Analysis

The vulnerability is a Stored XSS condition exposed through a WordPress shortcode. The appointmind_calendar shortcode accepts attributes supplied by post authors. The plugin passes these attributes into HTML output without applying WordPress sanitization helpers such as sanitize_text_field() on input or esc_attr() / esc_html() on output. An attacker who holds a contributor account can embed the shortcode in a draft or published post with attribute values containing HTML or JavaScript. When the page renders, the attacker-controlled markup executes in the context of the site's origin.

Because the payload is stored in the database, it executes repeatedly for every visitor who loads the page. The CVSS vector indicates a scope change, reflecting that the executed script runs in the browser of other users beyond the attacker.

Root Cause

The root cause is insufficient input sanitization and output escaping on shortcode attributes handled by the plugin. WordPress shortcode handlers receive an attribute array that must be validated and escaped before being emitted into HTML. The affected version of Appointmind concatenates attribute values directly into the rendered calendar markup, allowing injection of <script>, event-handler attributes such as onerror, or javascript: URIs.

Attack Vector

The attack path requires an authenticated session with contributor-level access or higher. The attacker creates or edits a post containing the appointmind_calendar shortcode with crafted attribute values. When an editor, administrator, or site visitor views the resulting page, the attacker's script runs. Follow-on actions include stealing authentication cookies, performing CSRF against admin endpoints, defacing content, or redirecting visitors to attacker-controlled infrastructure.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Intelligence entry and the WordPress Change Set Log for the applied fix.

Detection Methods for CVE-2025-9851

Indicators of Compromise

Posts or pages containing [appointmind_calendar ...] shortcode entries with attribute values that include <script>, onerror=, onload=, or javascript: strings.
Unexpected outbound requests from visitor browsers to third-party domains originating from pages rendering the shortcode.
New or modified WordPress administrator accounts following contributor activity on calendar-bearing posts.
Browser console errors or Content Security Policy violations tied to pages hosting the shortcode.

Detection Strategies

Query the wp_posts table for post_content matching the appointmind_calendar shortcode and inspect attribute values for HTML entities or script tokens.
Review WordPress audit logs for contributor-role users creating or updating posts that embed the shortcode.
Deploy a web application firewall rule to flag shortcode attributes containing <, >, or javascript: sequences in POST bodies to /wp-admin/post.php.

Monitoring Recommendations

Monitor role elevation events and new user creation immediately after contributor post edits.
Enable logging of all wp-admin POST requests and alert on anomalous shortcode payloads.
Track outbound JavaScript fetches via Content Security Policy report-only mode to surface injected script origins.

How to Mitigate CVE-2025-9851

Immediate Actions Required

Update the Appointmind plugin to a version later than 4.1.0 as soon as a patched release is available from the vendor.
Audit all posts and pages for the appointmind_calendar shortcode and remove any suspicious attribute values.
Review contributor and author accounts; disable or reset credentials for any account that recently added or modified calendar shortcodes.
Rotate administrator session cookies and secrets if evidence of exploitation is found.

Patch Information

The applied fix is referenced in the WordPress Change Set Log for the Appointmind plugin. Administrators should install the latest version from the WordPress plugin repository. If no patched release is available, deactivate and remove the plugin until a fix is published.

Workarounds

Deactivate the Appointmind plugin until a patched version is installed.
Restrict the contributor role or require administrator approval for all posts that include shortcodes.
Deploy a WAF rule that blocks shortcode attributes containing HTML tags or javascript: URIs on calendar-bearing pages.
Enforce a strict Content Security Policy that disallows inline scripts across the WordPress site.

bash

# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate appointmind
wp plugin status appointmind