Stored Cross-Site Scripting Vulnerability in OpenSheetMusicDisplay Plugin for WordPress

CVE-2025-5235

What is CVE-2025-5235?

The OpenSheetMusicDisplay plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. This flaw allows authenticated users with Contributor-level access and higher to inject malicious web scripts through the ‘className’ parameter. These scripts execute on targeted pages, posing a significant risk to unsuspecting users who access the compromised content. It is crucial for site administrators utilizing this plugin to apply security updates and implement best practices for input validation to mitigate this threat.

References