CVE-2025-9499
BaseFortify
Publication date: 2025-08-30
Last updated on: 2025-09-02
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | ocean_extra | 2.4.9 |
| wordpress | ocean_extra | 2.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Ocean Extra WordPress plugin (up to version 2.4.9) is a Stored Cross-Site Scripting (XSS) issue caused by insufficient input sanitization and output escaping in the plugin's oceanwp_library shortcode. Authenticated users with contributor-level access or higher can inject malicious scripts via the shortcode's 'id' attribute. These scripts then execute whenever any user views the affected page, potentially compromising site security. The vulnerability arises because the plugin did not properly validate or sanitize the 'id' attribute before rendering content from custom post types, allowing arbitrary script injection. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with contributor-level access or higher to inject malicious scripts into pages on your WordPress site. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious actions. This compromises the integrity and security of your website and its users. Since the vulnerability involves stored XSS, the malicious code persists on the site until removed or patched. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if your WordPress site is running the Ocean Extra plugin version 2.4.9 or earlier, which contains the vulnerable shortcode `[oceanwp_library]`. You can verify the plugin version via the WordPress admin dashboard or by running the command `wp plugin list | grep ocean-extra` if WP-CLI is installed. Additionally, inspecting pages or posts that use the `[oceanwp_library]` shortcode with user-supplied `id` attributes may reveal injected scripts. There are no specific network detection commands provided in the resources. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Ocean Extra plugin to version 2.5.0 or later, as this version includes a patch that properly validates shortcode attributes and restricts rendering to published templates of the correct post type, preventing exploitation. Until the update is applied, restrict contributor-level access to trusted users only to reduce the risk of exploitation. [1, 2]