CVE-2025-11872 is a stored cross-site scripting vulnerability in the Material Design Iconic Font Integration plugin for WordPress, affecting all versions up to and including version 2. The issue is due to improper neutralization of input during web page generation (CWE-79), specifically insufficient sanitization and output escaping of user-supplied attributes in the 'mdiconic' shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS 3.1 base score is 6.4, with attack vector network, low attack complexity, privileges required at the low level, no user interaction, and scope changed. The impact includes limited confidentiality and integrity loss but no availability impact. There is no vendor advisory or patch link provided, and the plugin is not a cloud service.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the context of users who view the infected pages, potentially leading to theft of session tokens, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity loss without affecting availability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin. Monitor official sources for updates or patches addressing this vulnerability.