CVE-2025-9852 is a stored cross-site scripting vulnerability in the Yoga Schedule Momoyoga WordPress plugin, affecting all versions up to 2.9.0. The issue arises from improper neutralization of user-supplied input in the 'momoyoga-schedule' shortcode attributes, allowing authenticated users with contributor-level permissions or higher to inject arbitrary scripts. These scripts execute in the context of any user accessing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Yoga Schedule Momoyoga plugin if feasible. Monitor official channels for updates regarding patches or mitigations.