Stored Cross-Site Scripting Vulnerability in Muse.ai Video Embedding Plugin for WordPress

CVE-2025-6262

What is CVE-2025-6262?

The Muse.ai video embedding plugin for WordPress is susceptible to stored cross-site scripting due to a lack of proper input sanitization and output escaping in the 'muse-ai' shortcode. This vulnerability affects all plugin versions up to and including 0.4. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious web scripts into pages. Such scripts will execute when users access the manipulated content, potentially leading to unauthorized actions on behalf of the user or exposure of sensitive information.

References