CVE-2025-11763: Display Pages Shortcode Plugin XSS Flaw

CVE-2025-11763 Overview

CVE-2025-11763 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Display Pages Shortcode plugin for WordPress. The flaw resides in the column_count parameter of the [display-pages] shortcode. All plugin versions up to and including 1.1 are affected due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who views the affected page.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript in published pages, enabling session theft, redirection, or administrative action hijacking against any user who loads the compromised content.

Affected Products

WordPress Display Pages Shortcode plugin, versions up to and including 1.1
WordPress sites permitting contributor-level or higher registrations
Any WordPress installation using the [display-pages] shortcode

Discovery Timeline

2025-11-21 - CVE-2025-11763 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11763

Vulnerability Analysis

The Display Pages Shortcode plugin registers a [display-pages] shortcode that accepts a column_count attribute controlling the layout of listed pages. The plugin fails to sanitize this attribute on input and does not escape it on output before rendering it into the page HTML. An attacker with contributor privileges can embed the shortcode in a post or page with a crafted column_count value containing HTML or JavaScript. When the page is rendered, the payload executes in the visitor's browser under the site's origin.

Exploitation requires authentication but no user interaction beyond viewing the affected page. Because the payload is stored in the WordPress database and delivered to every page viewer, it can be used to steal session cookies, perform actions on behalf of authenticated administrators, or redirect users to attacker-controlled infrastructure. The scope-changed impact reflects the ability of injected scripts to affect users beyond the attacker's own privilege boundary.

Root Cause

The plugin source referenced at lines 513 and 517 of display-pages-shortcode.php handles the column_count attribute without applying esc_attr(), absint(), or equivalent WordPress sanitization APIs. Numeric attributes should be cast to integers before being interpolated into HTML output.

Attack Vector

A contributor-level attacker creates or edits a post containing the shortcode with a malicious column_count value that breaks out of the intended HTML context. Once the post is viewed—including by administrators reviewing pending submissions—the script executes. See the Wordfence Vulnerability Report and the WordPress Plugin Code Snippet for the vulnerable code path.

Detection Methods for CVE-2025-11763

Indicators of Compromise

Post or page content containing [display-pages] shortcodes with non-numeric column_count values
Database entries in wp_posts where post_content includes column_count= followed by <, ", or script
Unexpected outbound requests from visitor browsers to unknown domains after loading pages using the shortcode
Newly created contributor accounts followed by shortcode-containing post submissions

Detection Strategies

Query the WordPress database for stored shortcode invocations containing suspicious column_count values
Deploy web application firewall rules that inspect shortcode attributes for HTML metacharacters
Monitor content-security-policy violation reports for inline script executions on pages rendering the shortcode

Monitoring Recommendations

Audit contributor and author account activity, especially post creation and revision events
Alert on installation of or updates to the Display Pages Shortcode plugin below a patched version
Track browser-side script errors and unexpected DOM modifications on public-facing pages

How to Mitigate CVE-2025-11763

Immediate Actions Required

Update the Display Pages Shortcode plugin to a version above 1.1 once a patched release is available
If no patched version exists, deactivate and remove the plugin from all affected WordPress sites
Review published and draft content for malicious [display-pages] shortcode usage and remove injected payloads
Rotate authentication cookies and passwords for administrator accounts that may have viewed compromised pages

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. Consult the Wordfence Vulnerability Report for the latest remediation status and follow the plugin listing on WordPress.org for updates.

Workarounds

Restrict contributor and author role assignments to trusted users only
Disable the [display-pages] shortcode by removing the plugin until a patch is verified
Deploy a web application firewall rule that blocks shortcode attributes containing <, >, or quote characters
Enforce a strict Content Security Policy that prohibits inline script execution on public pages

bash

# Locate stored payloads using WP-CLI
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[display-pages%column_count=%<%'"

# Deactivate the plugin site-wide
wp plugin deactivate display-pages-shortcode