Stored Cross-Site Scripting Vulnerability in Yoga Schedule Plugin for WordPress

CVE-2025-9852

What is CVE-2025-9852?

The Yoga Schedule Momoyoga plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS), specifically through its 'momoyoga-schedule' shortcode. This vulnerability arises from inadequate sanitization of user inputs and insufficient escaping of outputs, affecting all versions up to and including 2.9.0. Authenticated attackers with contributor-level access can exploit this issue, injecting arbitrary web scripts into pages. These scripts may execute whenever users visit the compromised pages, potentially leading to unauthorized actions and data exposure.

References