CVE-2025-11765 Overview
The Stock Tools plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 1.1. The flaw resides in the image_height and image_width shortcode attributes, which lack input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when any user views the affected page. The vulnerability was published to the National Vulnerability Database (NVD) on November 21, 2025.
Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account takeover, and redirection of site visitors to attacker-controlled infrastructure.
Affected Products
- Stock Tools plugin for WordPress, versions up to and including 1.1
- WordPress sites permitting contributor-level or higher registration
- Any WordPress installation rendering pages that embed the vulnerable shortcode
Discovery Timeline
- 2025-11-21 - CVE-2025-11765 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11765
Vulnerability Analysis
The Stock Tools plugin exposes a shortcode that accepts user-supplied image_height and image_width attributes. The plugin renders these values directly into HTML output without applying WordPress escaping functions such as esc_attr() or esc_html(). An attacker with contributor privileges can craft shortcode input containing HTML event handlers or <script> payloads. When an editor previews the post or a site visitor loads the published page, the injected JavaScript executes in the victim's browser under the site's origin.
The attack requires low privileges because contributor accounts are the lowest tier permitted to author post content in WordPress. Many sites accept contributor registrations to enable guest posts, expanding the attack surface. Because the payload is stored server-side, exploitation persists across sessions and users until the malicious content is purged.
Consult the WordPress Plugin Code Reference for the specific unsafe rendering location.
Root Cause
The root cause is missing input sanitization and output escaping in the shortcode handler. WordPress provides context-aware escaping APIs, but the plugin concatenates raw attribute values into the HTML img tag markup. This allows attribute-breakout via characters such as " followed by arbitrary event handlers like onerror or onload.
Attack Vector
The attack vector is network-based and requires authentication as a contributor or higher. An attacker publishes a post containing the vulnerable shortcode with a crafted image_width or image_height value that closes the HTML attribute and injects a JavaScript event handler. When an administrator reviews the pending post or a visitor loads the page, the payload executes and can hijack the session, exfiltrate authentication cookies, or perform actions on behalf of the victim.
See the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-11765
Indicators of Compromise
- Posts or pages containing Stock Tools shortcodes with unusual quote characters, angle brackets, or JavaScript event handlers in the image_height or image_width attributes
- Outbound browser requests from administrator sessions to unfamiliar external domains after loading plugin-rendered pages
- Unexpected creation of new administrator accounts or modification of user roles following contributor post approvals
Detection Strategies
- Audit the wp_posts table for shortcode instances where attribute values contain characters such as <, >, ", or the string on followed by an event handler name
- Enable Content Security Policy (CSP) reporting to surface inline script execution originating from rendered plugin content
- Review WordPress access logs for contributor accounts publishing content that references the vulnerable plugin shortcode
Monitoring Recommendations
- Alert on new or modified posts authored by contributor-level accounts that include Stock Tools shortcodes
- Monitor administrator browser sessions for anomalous cookie access, DOM modifications, or cross-origin requests
- Track plugin version inventory across managed WordPress sites and flag installations running Stock Tools 1.1 or earlier
How to Mitigate CVE-2025-11765
Immediate Actions Required
- Update the Stock Tools plugin to a version later than 1.1 as soon as a patched release is published
- Restrict new contributor registrations and audit existing contributor accounts for unfamiliar users
- Purge any stored posts containing suspicious image_height or image_width attribute values in the Stock Tools shortcode
Patch Information
At the time of NVD publication, all versions up to and including 1.1 are affected. Monitor the WordPress Plugin Repository and the Wordfence Vulnerability Report for updated fix availability and apply the patched release immediately.
Workarounds
- Deactivate and remove the Stock Tools plugin until a patched version is available
- Deploy a Web Application Firewall (WAF) rule that blocks requests containing script tags or HTML event handlers within shortcode attributes
- Enforce a strict Content Security Policy that disallows inline JavaScript execution on WordPress-rendered pages
- Downgrade contributor accounts to subscriber-level access if guest authorship is not operationally required
# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate stock-tools --allow-root
wp plugin delete stock-tools --allow-root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
