CVE-2025-11803 Overview
CVE-2025-11803 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPSite Shortcode plugin for WordPress. The flaw affects all versions up to and including 1.2. It stems from insufficient input sanitization and output escaping in error messages generated by the wpsite_y and wpsite_postauthor shortcodes. Attackers with contributor-level access or above can inject arbitrary JavaScript through the format attribute of the wpsite_y shortcode or the before attribute of the wpsite_postauthor shortcode. The injected script executes in any visitor's browser when they view an affected page. The weakness is classified under [CWE-79].
Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account takeover, and drive-by attacks against site visitors.
Affected Products
- WPSite Shortcode plugin for WordPress (all versions ≤ 1.2)
- WordPress sites permitting contributor-level or higher registration
- Any deployment using the wpsite_y or wpsite_postauthor shortcodes
Discovery Timeline
- 2025-11-21 - CVE-2025-11803 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11803
Vulnerability Analysis
The WPSite Shortcode plugin exposes multiple shortcodes that render user-supplied attribute values inside error messages. When a shortcode receives an invalid format (for wpsite_y) or before (for wpsite_postauthor) value, the plugin echoes the raw attribute back to the page without applying WordPress escaping functions such as esc_html() or esc_attr(). Contributor accounts, which can author but not publish posts, can embed a malicious shortcode invocation into draft content. Once an editor or administrator previews the draft, or once the content is published, the payload executes in the reviewer's browser context. This grants the attacker access to authenticated session cookies, nonces, and administrative REST endpoints. See the Wordfence Vulnerability Analysis for further context.
Root Cause
The root cause is missing output escaping in the plugin's shortcode handlers. The vulnerable code paths in shortcodes/wpsite-date.php at line 19, line 35, and line 51 concatenate attribute values directly into error message output. WordPress requires developers to sanitize input on save and escape output on render; the plugin does neither for the format and before attributes.
Attack Vector
An authenticated attacker with contributor-level privileges submits a post containing a crafted shortcode. The attribute payload includes HTML and JavaScript that the plugin renders unescaped when the shortcode error branch is triggered. The stored payload persists in the WordPress database and executes whenever a user renders the affected page. Because the scope is changed (S:C in the CVSS vector), the impact reaches beyond the vulnerable plugin into the WordPress admin session.
No verified public exploit code is available. See the Wordfence advisory and the referenced plugin source lines for technical details.
Detection Methods for CVE-2025-11803
Indicators of Compromise
- Post or page content in the wp_posts table containing [wpsite_y ...] or [wpsite_postauthor ...] shortcodes with <script>, onerror=, onload=, or javascript: payloads in the format or before attributes.
- Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains following a page preview or publish action.
- New administrator accounts, modified user roles, or unauthorized plugin installations after a contributor's content is reviewed.
Detection Strategies
- Query the WordPress database for shortcode invocations that include angle brackets or JavaScript event handlers within attribute values.
- Monitor web server access logs for requests to pages that return HTML containing reflected shortcode attribute content.
- Inspect contributor and author accounts for recent post activity that includes the affected shortcodes.
Monitoring Recommendations
- Enable WordPress audit logging to record post creation, updates, and role changes by non-administrator accounts.
- Deploy a web application firewall (WAF) with rules that block script tags and event handlers inside shortcode attributes.
- Alert on modifications to the wp_users and wp_usermeta tables outside of scheduled administrative activity.
How to Mitigate CVE-2025-11803
Immediate Actions Required
- Deactivate the WPSite Shortcode plugin until a patched release is available.
- Audit all posts, pages, and drafts for the wpsite_y and wpsite_postauthor shortcodes and remove suspicious attribute values.
- Review contributor, author, and editor accounts and revoke access for any account that is unrecognized or inactive.
- Force a password reset and invalidate active sessions for administrator accounts that previewed contributor content since the plugin was installed.
Patch Information
At the time of the last NVD update on 2026-06-17, no vendor-supplied patched version is listed in the enriched CVE data. Monitor the WordPress plugin repository for a release above version 1.2 and apply it as soon as it becomes available.
Workarounds
- Restrict contributor-level and higher access to trusted users only, and disable open registration for these roles.
- Configure a WAF rule to strip HTML tags and JavaScript event handlers from shortcode attribute values in POST requests to /wp-admin/post.php and /wp-json/wp/v2/posts.
- Replace the vulnerable plugin with an actively maintained shortcode plugin that properly escapes output using esc_attr() and esc_html().
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
