PT-2025-47685 · WordPress · Audiotube

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-11801

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AudioTube plugin for WordPress versions up to and including 0.0.3

Description The AudioTube plugin for WordPress is susceptible to Stored Cross-Site Scripting. The issue stems from inadequate input sanitization and output escaping within the 'caption' shortcode attribute of the 'audiotube' shortcode. This allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. These scripts will then execute when a user accesses the compromised page.

Recommendations Update the AudioTube plugin to a version beyond 0.0.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-11801

Affected Products

Audiotube

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11801 · Security Note
• https://twitter.com/VulmonFeeds/status/1991842279724593461 · Twitter Post
• https://twitter.com/CVEnew/status/1991776217612321191 · Twitter Post
• https://plugins.trac.wordpress.org/browser/audiotube/tags/0.0.3/index.php#L64 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/258a2d5d-a176-4b89-bc4c-089d072982dd?source=cve · Note