CVE-2025-6262

MEDIUM

2025-07-24 [email protected]

WordPress XSS

6.4

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 24, 2025 - 10:15 nvd

MEDIUM 6.4

DescriptionNVD

The muse.ai video embedding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's muse-ai shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in muse.ai WordPress plugin versions up to 0.4 allows authenticated attackers with contributor-level access to inject malicious scripts via insufficiently sanitized shortcode attributes, enabling arbitrary code execution in the context of any user viewing affected pages. The vulnerability requires authentication and user interaction (page access by victims), resulting in a CVSS 6.4 score; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The muse.ai plugin processes user-supplied attributes within its muse-ai WordPress shortcode without proper input sanitization or output HTML escaping (CWE-79: Improper Neutralization of Input During Web Page Generation). WordPress shortcodes are dynamic content placeholders that accept arbitrary attributes; when these attributes are rendered to the DOM without escaping special characters, attackers can inject malicious JavaScript. The vulnerability chain involves: (1) authenticated user submitting a post/page with crafted shortcode attributes, (2) insufficient sanitization during attribute parsing, and (3) unescaped output rendering the attribute values directly in HTML context. This allows script injection payloads (e.g., javascript: or event handlers) to persist in the database as part of page content, executing each time any user views that page.

Affected ProductsAI

The muse.ai video embedding plugin for WordPress is affected in all versions up to and including 0.4. The plugin is hosted on WordPress.org (wordpress.org/plugins/muse-ai/) and identifies itself via the slug 'muse-ai'. No specific CPE string is publicly assigned for WordPress plugins in most vulnerability databases; however, the affected software can be referenced as WordPress plugin 'muse-ai' versions ≤0.4. Administrators should consult the WordPress plugin repository and Wordfence threat intelligence for version confirmation and patch availability.

RemediationAI

Update the muse.ai plugin to a version newer than 0.4 as soon as available. The WordPress plugin repository (wordpress.org/plugins/muse-ai/#developers) and Wordfence vulnerability advisory (wordfence.com/threat-intel/vulnerabilities/id/790d6336-0c16-4058-9ddb-d182ef56263c) provide patch references and developer information. Until a patched version is released, restrict contributor-level access to trusted administrators only, disable the plugin if not in active use, or review all existing uses of the muse-ai shortcode on your site to identify and remove any suspicious attributes. Implement content security policies (CSP) headers as an additional defense layer to mitigate stored XSS impact.

CVE-2025-6262 vulnerability details – vuln.today

Back