CVE-2025-11502 Overview
CVE-2025-11502 is a Stored Cross-Site Scripting (XSS) vulnerability in the Schema & Structured Data for WP & AMP plugin for WordPress. The flaw affects all versions up to and including 1.51. It resides in the plugin's saswp_tiny_multiple_faq shortcode, which fails to properly sanitize input and escape output on user-supplied attributes [CWE-79].
Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who loads the affected page, enabling session theft, forced redirects, or administrative action abuse when a privileged user views the content.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against every visitor, including administrators, on WordPress sites running the vulnerable plugin.
Affected Products
- Schema & Structured Data for WP & AMP plugin for WordPress
- All versions up to and including 1.51
- Sites permitting contributor-level or higher user registration
Discovery Timeline
- 2025-11-01 - CVE-2025-11502 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11502
Vulnerability Analysis
The vulnerability originates in the plugin's TinyMCE shortcode registration module at modules/tinymce/register-shortcodes.php. The saswp_tiny_multiple_faq shortcode handler accepts user-supplied attributes and renders them into page output without adequate sanitization or contextual escaping.
Because WordPress evaluates shortcodes when a page or post is rendered, injected payloads persist in the database and execute on every subsequent view. The Scope Changed CVSS component reflects that the script executes in the browser context of any visitor, extending impact beyond the vulnerable component. A contributor account, which normally cannot publish content directly, becomes sufficient to compromise administrator sessions when an admin previews or reviews the malicious content.
Root Cause
The root cause is missing input sanitization and missing output escaping around shortcode attribute values. WordPress provides helper functions such as esc_attr(), esc_html(), and wp_kses() for sanitizing user-controlled data. The vulnerable code path passes attribute values into the rendered HTML without applying these controls, allowing attacker-supplied strings to be interpreted as executable markup.
Attack Vector
An authenticated attacker with contributor privileges creates or edits a post containing the saswp_tiny_multiple_faq shortcode with malicious attribute values, such as an onerror handler or embedded <script> tag delivered through attribute injection. When any authenticated or unauthenticated user views the resulting page, the payload executes with the victim's browser privileges against the site origin. This enables cookie theft, CSRF against the WordPress REST API, and privilege escalation if an administrator triggers the payload.
See the WordPress Plugin Code Snippet and the fix changeset for the specific code path.
Detection Methods for CVE-2025-11502
Indicators of Compromise
- Posts or pages authored by contributor accounts containing the saswp_tiny_multiple_faq shortcode with unusual attribute values such as onerror=, onload=, javascript:, or embedded <script> fragments.
- New administrator-level user accounts created shortly after a contributor submitted or edited content containing the shortcode.
- Outbound requests from site visitors' browsers to unfamiliar domains initiated from pages rendering the plugin's FAQ shortcode.
Detection Strategies
- Query the wp_posts table for post_content containing saswp_tiny_multiple_faq and inspect attributes for HTML event handlers, script tags, or encoded payloads.
- Review WordPress user activity logs for contributor accounts creating or editing pages that include structured-data shortcodes.
- Monitor web server access logs for anomalous JavaScript-driven request patterns originating from pages that use the plugin.
Monitoring Recommendations
- Enable a Content Security Policy (CSP) that restricts inline script execution and log CSP violation reports.
- Alert on privilege changes, new administrator creation, and password resets on WordPress installations running the affected plugin.
- Track plugin version inventory across managed WordPress sites to identify hosts still on version 1.51 or earlier.
How to Mitigate CVE-2025-11502
Immediate Actions Required
- Update the Schema & Structured Data for WP & AMP plugin to a version later than 1.51 that contains the fix committed in changeset 3387089.
- Audit existing posts and pages for the saswp_tiny_multiple_faq shortcode and remove any suspicious attribute content before end users can trigger it.
- Review contributor, author, and editor accounts, and revoke access for any that are unknown or unused.
Patch Information
The vendor addressed the issue in the plugin repository via changeset 3387089. Additional details are available in the Wordfence Vulnerability Report. Administrators should install the patched release through the WordPress plugin updater or by replacing the plugin directory manually.
Workarounds
- Restrict the shortcode by disabling the plugin until the patched version can be deployed.
- Limit user registration and downgrade untrusted contributor accounts to subscriber level until the update is verified.
- Deploy a Web Application Firewall (WAF) rule that blocks HTML event handlers and <script> tags within shortcode attributes submitted to wp-admin/post.php and the REST API.
# Disable the vulnerable plugin from the command line using WP-CLI
wp plugin deactivate schema-and-structured-data-for-wp
# After updating, verify the installed version is greater than 1.51
wp plugin get schema-and-structured-data-for-wp --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
