CVE-2025-9859: Fintelligence Calculator XSS Vulnerability

CVE-2025-9859 Overview

The Fintelligence Calculator plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the fintelligence-calculator shortcode. The flaw affects all versions up to and including 1.0.3. It stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes [CWE-79].

Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who views the affected page. This creates a path for session theft, administrator account compromise, and arbitrary actions performed in a victim's context.

Critical Impact
Contributor-level accounts can plant persistent JavaScript that executes against site administrators and visitors, enabling account takeover and content manipulation.

Affected Products

Fintelligence Calculator plugin for WordPress — all versions ≤ 1.0.3
WordPress sites allowing contributor-level user registration
WordPress sites rendering the fintelligence-calculator shortcode

Discovery Timeline

2025-10-03 - CVE-2025-9859 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9859

Vulnerability Analysis

The vulnerability lives in the shortcode registration logic defined in src/inc/class-register-shortcodes.php. The handler accepts shortcode attributes supplied by any user able to author posts or pages. Those attributes are concatenated into HTML output without proper sanitization or escaping before being returned to the browser.

Because WordPress contributors can save posts containing shortcodes, an attacker with contributor privileges can embed a malicious fintelligence-calculator shortcode. When an editor, administrator, or site visitor loads the page, the attacker-controlled payload executes in their browser session.

The scope change in the CVSS metrics reflects that script executes in the trusted origin of the WordPress site, affecting resources beyond the attacker's own account. Successful exploitation can lead to administrative session hijacking, forced actions through authenticated requests, defacement, and redirection to attacker-controlled infrastructure.

Root Cause

The shortcode handler fails to apply WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses() to attribute values before rendering them. Input validation on the attributes is also missing, allowing raw HTML and JavaScript to pass through unchanged.

Attack Vector

An authenticated attacker with contributor-level access creates or edits a post containing the fintelligence-calculator shortcode with a malicious attribute value. The payload persists in the WordPress database. When any user renders the containing page, the browser parses and executes the injected script. See the WordPress Plugin Source File and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-9859

Indicators of Compromise

Posts or pages authored by contributor accounts containing fintelligence-calculator shortcodes with unusual attribute values
Shortcode attribute strings containing <script>, onerror=, onload=, javascript:, or encoded variants
Unexpected outbound requests from editor browsers to third-party domains after loading affected pages
New administrator accounts or privilege changes shortly after contributor-authored content is reviewed

Detection Strategies

Query the wp_posts table for post_content entries that reference the fintelligence-calculator shortcode and inspect attribute values
Review the plugin version via wp plugin list and flag installations at or below 1.0.3
Instrument web application firewall logs for shortcode submissions containing script tags or JavaScript event handlers

Monitoring Recommendations

Monitor authenticated POST requests to wp-admin/post.php and wp-admin/post-new.php from contributor-role accounts
Alert on Content Security Policy (CSP) violations originating from pages that embed the vulnerable shortcode
Track creation of new high-privilege users and modifications to the wp_users and wp_usermeta tables

How to Mitigate CVE-2025-9859

Immediate Actions Required

Deactivate the Fintelligence Calculator plugin until a patched release is available
Audit all posts and pages for fintelligence-calculator shortcodes and remove suspicious attribute values
Review contributor-level accounts, rotate credentials, and remove accounts that are not required
Force password resets for all administrator accounts that may have viewed attacker-authored drafts

Patch Information

At the time of publication, no fixed version is listed in the referenced advisories for versions above 1.0.3. Monitor the Wordfence Vulnerability Report and the plugin repository for an updated release that applies esc_attr() and related escaping functions to shortcode attributes.

Workarounds

Restrict shortcode usage by removing the fintelligence-calculator shortcode via remove_shortcode() in a mu-plugin until a patch ships
Limit the contributor role capabilities so untrusted users cannot author posts containing shortcodes
Deploy a web application firewall rule that blocks POST bodies containing the shortcode name combined with <script, on event handlers, or javascript: URIs
Enforce a strict Content Security Policy that disallows inline script execution on front-end pages

bash

# Disable the vulnerable shortcode via WP-CLI until a patch is available
wp eval 'remove_shortcode("fintelligence-calculator");'

# Identify posts containing the shortcode for review
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[fintelligence-calculator%';"