CVE-2025-9129

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9129", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-18T21:07:34.688Z", "datePublished": "2025-10-03T11:17:21.396Z", "dateUpdated": "2026-04-08T17:23:56.321Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:56.321Z"}, "affected": [{"vendor": "odude", "product": "Flexi \u2013 Guest Submit", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.28", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfd4949-07ae-48b6-9aa2-82fd6b1bf692?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/flexi/trunk/includes/class-flexi-form.php#L572"}, {"url": "https://wordpress.org/plugins/flexi/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-10-02T22:16:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T13:58:08.526741Z", "id": "CVE-2025-9129", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:58:15.917Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T13:58:08.526741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:58:13.359Z"}}], "cna": {"title": "Flexi <= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "odude", "product": "Flexi \u2013 Guest Submit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.28"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:16:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfd4949-07ae-48b6-9aa2-82fd6b1bf692?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/flexi/trunk/includes/class-flexi-form.php#L572"}, {"url": "https://wordpress.org/plugins/flexi/#developers"}], "descriptions": [{"lang": "en", "value": "The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:56.321Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9129", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:23:56.321Z", "dateReserved": "2025-08-18T21:07:34.688Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:21.396Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Flexi \u2013 Guest Submit", "vendor": "odude", "versions": [{"lessThanOrEqual": "4.28", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and including, 4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Flexi para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode flexi-form-tag del plugin para WordPress en todas las versiones hasta la 4.28, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9129", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9129", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T13:58:08.526741Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:45.870", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/flexi/trunk/includes/class-flexi-form.php#L572"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/flexi/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccfd4949-07ae-48b6-9aa2-82fd6b1bf692?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:21:50.430210+00:00", "value": {"mitigation_remediation": ["Upgrade the Flexi plugin to a version newer than 4.28, which removes the flaw in the shortcode handling.", "If an immediate upgrade is not possible, disable or remove the flexi\u2011form\u2011tag shortcode from all pages to prevent stored scripts from executing.", "Deploy a Content Security Policy that blocks inline execution of scripts and set XSS\u2011filtering headers on the WordPress site to reduce the impact of any lingering injected code."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated users with contributor or higher privileges to inject malicious scripts into pages and cause them to run for all visitors"}, "threat_synthesis": {"affected_systems": "All installations of the Flexi plugin version 4.28 or earlier are susceptible. The issue is specifically tied to the flexi\u2011form\u2011tag shortcode handling in the plugin\u2019s user interface. The affected environment is a WordPress site hosting the Flexi \u201cGuest Submit\u201d component.", "description_and_impact": "The vulnerability arises from the Flexi for WordPress plugin, which permits insufficient sanitization and escaping of user supplied attributes in the flexi\u2011form\u2011tag shortcode. An authenticated WordPress user with contributor-level access can embed malicious JavaScript that is stored and subsequently executed whenever the page containing the shortcode is viewed by any user. This Stored XSS can lead to session hijacking, defacement, or phishing attacks within the affected site, compromising both confidentiality and integrity of user data.", "risk_and_exploitability": "With a CVSS score of 6.4, the exposure is considered moderate but significant. The EPSS score of less than 1% indicates a very low likelihood of mass exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack surface requires an authenticated contributor or higher, which many sites may have, making the risk realistic for active sites. The most probable attack vector involves an attacker creating or editing a page that incorporates the flexi\u2011form\u2011tag shortcode to embed payloads that persist in the database."}}}}, "created": "2025-10-06T14:42:49.115856+00:00", "updated": "2026-04-20T19:30:06.164763+00:00", "vendors": ["odude", "odude$PRODUCT$flexi", "wordpress", "wordpress$PRODUCT$wordpress"]}