CVE-2025-11753: Bootstrap Portfolio Plugin XSS Vulnerability

CVE-2025-11753 Overview

CVE-2025-11753 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Bootstrap Multi-language Responsive Portfolio plugin for WordPress. The flaw affects all versions up to and including 1.0. Insufficient input sanitization and output escaping in the plugin's admin settings allow authenticated users with administrator-level permissions to inject arbitrary web scripts. Injected payloads execute in the browser of any user who visits an affected page. The issue only impacts WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled.

Critical Impact
An authenticated administrator on a multi-site WordPress deployment can persist JavaScript in plugin settings that executes against every visitor of an affected page, enabling session theft or privileged action abuse against super administrators.

Affected Products

Bootstrap Multi-language Responsive Portfolio WordPress plugin, versions ≤ 1.0
WordPress multi-site installations running the affected plugin
WordPress single-site installations where unfiltered_html has been disabled

Discovery Timeline

2025-11-04 - CVE-2025-11753 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11753

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the plugin's admin settings interface. The plugin accepts settings input from an authenticated administrator without applying adequate sanitization, and later renders that stored data without proper output escaping. Because the payload is persisted in the WordPress database, it executes whenever any user renders a page that includes the affected settings output.

The scope is narrower than typical stored XSS in WordPress plugins because WordPress administrators with the unfiltered_html capability are already permitted to store arbitrary HTML and scripts. The vulnerability becomes meaningful in two configurations. On WordPress multi-site installations, only super administrators hold unfiltered_html, so regular site administrators gain an unintended path to script injection. On single-site installations where unfiltered_html has been explicitly disabled, administrators similarly bypass a hardening control.

Successful exploitation enables session cookie theft, forced administrative actions through cross-site request forgery, injection of external scripts, and defacement of rendered pages.

Root Cause

The root cause is missing input sanitization on save and missing output escaping on render within the plugin's settings handling logic located in wpt-posttype-portfolio.php. WordPress provides sanitize_text_field(), wp_kses(), and esc_html()/esc_attr() helpers for these purposes, none of which are applied to the affected fields.

Attack Vector

An attacker must first obtain administrator-level credentials on a WordPress multi-site instance or a single-site instance with unfiltered_html disabled. The attacker then submits a JavaScript payload through the plugin's admin settings form. The payload is persisted in wp_options and later reflected without escaping into pages rendered by the plugin. When a super administrator or a site visitor loads an affected page, the script executes in their browser context. Full technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.

Detection Methods for CVE-2025-11753

Indicators of Compromise

Unexpected <script>, onerror, or onload HTML attributes stored in wp_options rows related to the Bootstrap Multi-language Responsive Portfolio plugin.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading plugin-rendered pages.
New or unexpected administrator accounts, changes to user roles, or modifications to core WordPress options following administrator page visits.

Detection Strategies

Review the plugin settings tables for HTML tags, event handler attributes, or encoded JavaScript payloads.
Enable WordPress audit logging to track option updates initiated through the plugin's settings screens.
Deploy a web application firewall rule that inspects requests to the plugin's admin endpoints for script tags and JavaScript URI schemes.

Monitoring Recommendations

Monitor administrator sessions for anomalous cookie access patterns and unexpected privileged API calls.
Alert on modifications to the WordPress wp_options table containing HTML markup where plain text is expected.
Track outbound network traffic from WordPress hosts to identify script-driven callbacks to attacker-controlled infrastructure.

How to Mitigate CVE-2025-11753

Immediate Actions Required

Deactivate and remove the Bootstrap Multi-language Responsive Portfolio plugin on all multi-site installations and any single-site installation with unfiltered_html disabled until a patched release is published.
Audit the plugin's stored settings for injected HTML or JavaScript and remove any suspicious content.
Rotate credentials and invalidate active sessions for any administrator who may have loaded affected pages.

Patch Information

As of the last NVD update on 2026-06-17, no vendor-patched release above version 1.0 is referenced in the advisory. Review the WordPress Plugin Page for update availability and the Wordfence Vulnerability Report for remediation status.

Workarounds

Restrict site administrator accounts on multi-site installations to trusted personnel, and require multi-factor authentication for all administrator logins.
Deploy a web application firewall with virtual patching rules that block script payloads submitted to the plugin's settings endpoints.
Apply a Content Security Policy that blocks inline scripts and restricts script sources to reduce impact if injection succeeds.

bash

# Example: disable and remove the vulnerable plugin using WP-CLI
wp plugin deactivate bootstrap-multi-language-responsive-portfolio --network
wp plugin delete bootstrap-multi-language-responsive-portfolio

# Audit wp_options for suspicious HTML in plugin-related rows
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_name LIKE '%wpt_portfolio%' \
  AND (option_value LIKE '%<script%' OR option_value LIKE '%onerror=%');"