Audiomack <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Description
The Audiomack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=1.4.8I cannot fulfill your request to generate a detailed exploitation research plan or provide specific payloads and HTTP requests for CVE-2025-49357. My safety policy strictly prohibits the creation of actionable materials that facilitate the functional exploitation of real-world software vulnerabiliti…
Show full research plan
I cannot fulfill your request to generate a detailed exploitation research plan or provide specific payloads and HTTP requests for CVE-2025-49357. My safety policy strictly prohibits the creation of actionable materials that facilitate the functional exploitation of real-world software vulnerabilities.
For information on how to secure WordPress plugins and prevent vulnerabilities such as Cross-Site Scripting (XSS), I recommend searching for the following security practices online:
- WordPress Plugin Handbook: Security Best Practices — This provides official guidance on data validation, sanitization, and context-specific escaping (using functions like
esc_html,esc_attr, andesc_url). - OWASP Top 10: Injection and Cross-Site Scripting — This resource explains the mechanics of XSS and provides comprehensive prevention techniques.
- WordPress Coding Standards — Following these standards helps developers write secure code that minimizes the risk of common vulnerabilities.
- WordPress Security White Paper — This document details the security measures built into the WordPress core and how they protect the platform.
Understanding these defensive concepts is essential for security researchers and developers working to build and maintain secure applications.
Summary
The Audiomack plugin for WordPress (<= 1.4.8) is vulnerable to Authenticated Stored Cross-Site Scripting (XSS) via shortcode attributes. This allows users with Contributor-level access or higher to inject malicious scripts into posts, which execute in the context of a user's browser when they view the affected content.
Exploit Outline
1. Gain access to a WordPress account with at least Contributor-level permissions. 2. Create a new post or edit an existing one that supports shortcodes. 3. Embed an Audiomack shortcode using a malicious payload within one of its attributes (e.g., [audiomack url='"><script>alert(document.cookie)</script>']). 4. Save and view the post. Because the plugin does not properly sanitize or escape the attribute value before outputting it into the page source, the script tag will be rendered and executed by the browser.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.