CVE-2025-9860 Overview
The Mixtape plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.1. The flaw resides in the plugin's mixtape shortcode handler, which fails to sanitize user-supplied attributes and escape output before rendering. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when any visitor loads the affected page. The issue is tracked as [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated contributors can persist arbitrary JavaScript in WordPress posts, enabling session theft, administrative action hijacking, and site defacement against any user who views the injected page.
Affected Products
- WordPress Mixtape plugin, all versions through 1.1
- WordPress sites allowing contributor-or-above account registration
- WordPress deployments that render the mixtape shortcode in published content
Discovery Timeline
- 2025-09-11 - CVE-2025-9860 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-9860
Vulnerability Analysis
The vulnerability lives in the shortcode rendering logic exposed by class-mixtape-front.php at line 75. The handler accepts attributes passed through the [mixtape] shortcode and emits them directly into the HTML response. Because the plugin omits both input sanitization (for example sanitize_text_field) and output escaping (for example esc_attr or esc_html), attacker-controlled attribute values reach the browser verbatim.
The stored nature of the flaw amplifies impact. Shortcode attributes are persisted as part of the post content in wp_posts.post_content. Each subsequent page view re-renders the attacker payload against the viewer's session, including administrators who moderate or edit contributor submissions. This creates a reliable path to privilege escalation when an administrator loads the affected post.
Root Cause
The root cause is missing input validation and output encoding in the mixtape shortcode callback. WordPress shortcode attributes are untrusted by default and must be filtered before use. The plugin treats attribute values as safe strings and concatenates them into HTML markup without context-aware escaping, violating standard WordPress coding guidance for shortcode handlers.
Attack Vector
An attacker first obtains a contributor-level account on the target WordPress site. The attacker then creates or edits a post that embeds the [mixtape] shortcode with a malicious attribute value containing an HTML event handler or script fragment. When the post is viewed, the browser parses the unescaped attribute and executes the injected script in the context of the WordPress origin. See the WordPress Mixtape Source Code and the Wordfence Vulnerability Report for the vulnerable code path.
Detection Methods for CVE-2025-9860
Indicators of Compromise
- Posts or pages containing [mixtape] shortcodes whose attribute values include <script>, javascript:, or inline event handlers such as onerror= or onload=.
- Unexpected outbound requests from browsers rendering plugin-powered pages to attacker-controlled domains.
- New administrator accounts or role changes correlated with contributors submitting Mixtape shortcode content.
Detection Strategies
- Query the wp_posts table for post_content matching regular expressions that combine mixtape with script keywords or HTML event attributes.
- Review contributor and author audit logs for post edits that introduce or modify [mixtape] shortcodes.
- Scan rendered page HTML for script tags or event handlers originating inside Mixtape shortcode output.
Monitoring Recommendations
- Enable a web application firewall rule set that inspects shortcode attribute payloads for XSS patterns.
- Alert on Content Security Policy (CSP) violation reports from pages that embed the mixtape shortcode.
- Monitor authenticated session anomalies, such as administrator cookies being used from new IP addresses shortly after viewing contributor content.
How to Mitigate CVE-2025-9860
Immediate Actions Required
- Deactivate the Mixtape plugin on all WordPress sites until a patched release is available.
- Audit existing posts for [mixtape] shortcodes and remove or sanitize suspicious attribute values.
- Restrict new contributor account registration and review recently created low-privilege accounts.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. All releases up to and including 1.1 are affected. Monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for an updated version, and apply it as soon as it ships.
Workarounds
- Remove the plugin entirely if it is not business-critical, as a minor-impact Stored XSS still enables account takeover chains.
- Enforce a strict Content Security Policy that disallows inline scripts to blunt payload execution.
- Limit the unfiltered_html capability and keep contributor permissions at the WordPress default, which already blocks raw HTML submission.
# Disable the Mixtape plugin via WP-CLI across a WordPress site
wp plugin deactivate mixtape
wp plugin delete mixtape
# Audit stored content for injected shortcodes
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
WHERE post_content REGEXP '\\[mixtape[^]]*(script|onerror|onload|javascript:)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
