CVE-2025-11764: WordPress Shortcodes Bootstrap XSS Flaw

CVE-2025-11764 Overview

CVE-2025-11764 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes Bootstrap plugin for WordPress. The flaw affects all versions up to and including 1.1. The vulnerability resides in the type parameter of the [notification] shortcode, where the plugin fails to sanitize input and escape output. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, account takeover, and administrative privilege escalation when higher-privileged users view the injected content.

Affected Products

Shortcodes Bootstrap plugin for WordPress — all versions ≤ 1.1
WordPress sites accepting contributor-or-above registrations
Sites rendering the [notification] shortcode from untrusted authors

Discovery Timeline

2025-11-21 - CVE-2025-11764 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11764

Vulnerability Analysis

The Shortcodes Bootstrap plugin registers a [notification] shortcode that renders Bootstrap-style alert boxes. The shortcode accepts a type attribute intended to control the alert style (for example, success, warning, or danger). The plugin concatenates this attribute directly into the rendered HTML output without applying sanitization or escaping functions such as esc_attr().

An attacker with contributor privileges can author a post containing a crafted shortcode. When the post is previewed by an editor or published and viewed by site visitors, the injected script executes in the victim's browser session. Because contributor accounts are commonly granted through open registration workflows, the attack surface is broad. Successful exploitation can lead to administrative session hijacking, forced administrative actions via authenticated requests, or drive-by redirection of site visitors.

Root Cause

The root cause is missing input validation and missing output encoding in the shortcode handler located in inc/dws_alert.php. Attribute values passed through the WordPress shortcode API are trusted and inserted into the DOM as-is. WordPress provides esc_attr() and sanitize_html_class() for exactly this scenario, but the plugin does not invoke them.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated account with contributor privileges or higher. No user interaction is needed beyond a victim loading the page containing the malicious shortcode. The attacker crafts a shortcode where the type attribute breaks out of the surrounding HTML attribute context and introduces an event handler or <script> tag. Once saved to the database, the payload persists and executes for every subsequent viewer of the page. See the Wordfence Vulnerability Analysis and the WordPress Shortcode Plugin Code for technical details.

Detection Methods for CVE-2025-11764

Indicators of Compromise

Post or page content in wp_posts containing [notification shortcodes with type values including quote characters, angle brackets, on*= handlers, or javascript: URIs
Unexpected <script> tags, iframes, or event handlers rendered inside Bootstrap alert <div> elements
New administrator accounts or role changes following contributor activity
Outbound requests from visitor browsers to attacker-controlled domains after loading affected pages

Detection Strategies

Query the WordPress database for shortcode payloads: SELECT ID, post_author FROM wp_posts WHERE post_content REGEXP '\\[notification[^\\]]*type="[^"]*[<>"]'
Review web server access logs for POST requests to wp-admin/post.php from contributor-tier accounts that include shortcode markup with suspicious characters
Deploy a Web Application Firewall (WAF) rule to flag shortcode attributes containing HTML metacharacters
Audit contributor and author accounts for recent registrations correlated with content edits

Monitoring Recommendations

Enable WordPress audit logging to capture post creation and revision events by low-privileged users
Monitor administrator session cookies for use from unexpected IP addresses or user agents
Alert on privilege escalation events, particularly role changes to administrator or editor
Forward WordPress and web server logs to a centralized analytics platform for correlation across authoring, viewing, and follow-on activity

How to Mitigate CVE-2025-11764

Immediate Actions Required

Deactivate the Shortcodes Bootstrap plugin until a patched version is available
Audit all posts and pages containing the [notification] shortcode and remove any that contain suspicious type attribute values
Restrict new contributor registrations and review recent contributor-tier account activity
Rotate administrator passwords and invalidate active sessions if any injection is confirmed

Patch Information

At the time of NVD publication, all versions up to and including 1.1 are affected. Administrators should monitor the plugin's WordPress.org repository and the Wordfence advisory for a fixed release and upgrade as soon as one is published.

Workarounds

Uninstall the plugin and replace [notification] shortcode usage with hard-coded Bootstrap alert HTML authored by trusted editors
Limit shortcode-capable roles to trusted users only by removing unfiltered_html and restricting contributor content to plain text
Deploy WAF rules that block shortcode attributes containing <, >, ", or on[a-z]+= sequences
Enforce a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate shortcodes-bootstrap
wp plugin delete shortcodes-bootstrap

# Identify potentially injected content
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[notification%' \
  AND post_content REGEXP 'type=\"[^\"]*[<>]';"