CVE-2025-11767: WordPress Tips Shortcode XSS Vulnerability

CVE-2025-11767 Overview

CVE-2025-11767 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tips Shortcode plugin for WordPress. The flaw affects all versions up to and including 0.2.1. The plugin's tip shortcode fails to sanitize input and escape output correctly. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. The issue is tracked as CWE-79.

Critical Impact
Contributor-level accounts can persist JavaScript payloads that execute in visitors' browsers, enabling session theft, administrative action hijacking, and site defacement.

Affected Products

WordPress Tips Shortcode plugin, all versions through 0.2.1
WordPress sites permitting contributor-level or higher user registration
WordPress installations with the vulnerable tips_shortcode.php handler active

Discovery Timeline

2025-11-21 - CVE-2025-11767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11767

Vulnerability Analysis

The Tips Shortcode plugin registers a tip shortcode that renders user-supplied content back into rendered pages. The handler in tips_shortcode.php accepts shortcode attributes and content but does not apply WordPress sanitization functions before echoing the value into HTML output.

Because WordPress contributors can author posts containing shortcodes, any contributor can embed a [tip] shortcode whose payload contains HTML or JavaScript. The payload is stored in the post and rendered without escaping when the post is viewed. The scope-changed impact reflects that the injected script executes in the browser context of any visitor, including administrators.

Exploitation requires only low-privilege authenticated access and no user interaction beyond visiting the affected page.

Root Cause

The root cause is missing input sanitization and output escaping in the shortcode handler. WordPress provides helpers such as esc_html(), esc_attr(), and wp_kses_post() for this purpose. The vulnerable code path passes attacker-controlled shortcode content directly into the rendered HTML. See the WordPress Plugin Code Reference for the exact line involved.

Attack Vector

An attacker authenticates as a contributor and creates a draft post or page. The post includes a [tip] shortcode with attribute values or inner content containing a JavaScript payload such as an inline event handler or <script> tag. Once the post is published or previewed by a higher-privileged user, the script executes in that user's session. Additional detail is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11767

Indicators of Compromise

Post or page content containing [tip] shortcodes with embedded <script> tags, onerror=, onload=, or javascript: URIs
Unexpected outbound requests from administrator browsers to attacker-controlled domains following a post preview or view
New administrator accounts, modified user roles, or altered site options that correlate with contributor account activity

Detection Strategies

Query the wp_posts table for post_content values containing [tip combined with common XSS tokens such as <script, onerror, or onload
Review contributor-authored posts in draft or pending state before an editor approves them
Correlate WordPress audit logs of post creation events with subsequent administrative changes

Monitoring Recommendations

Enable a WordPress activity log plugin to record shortcode usage, post creation, and role changes
Deploy a Web Application Firewall (WAF) rule set that inspects request bodies for XSS payloads within shortcode attributes
Monitor browser Content Security Policy (CSP) violation reports to surface unauthorized script execution attempts

How to Mitigate CVE-2025-11767

Immediate Actions Required

Deactivate the Tips Shortcode plugin until a patched release is available
Audit existing posts and pages for [tip] shortcodes containing suspicious script content and remove them
Restrict contributor account creation and review pending posts before publication

Patch Information

As of the last NVD update, no fixed version has been published. Versions up to and including 0.2.1 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for update availability.

Workarounds

Remove the plugin entirely if the tip shortcode is not required for site functionality
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized external script sources
Limit the edit_posts capability so that only trusted users can author shortcode-containing content

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate tips-shortcode
wp plugin delete tips-shortcode

# Search post content for suspicious shortcode payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[tip%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%onload=%');"