CVE-2025-11804: JB News Ticker WordPress Plugin XSS Flaw

CVE-2025-11804 Overview

The JB News Ticker plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.0. The flaw resides in the id shortcode attribute of the jbticker shortcode. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access or above to inject arbitrary web scripts. Injected scripts execute in the browser of any user who visits an affected page. The vulnerability is categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript in WordPress pages, enabling session theft, forced redirects, and administrative account takeover when higher-privileged users view the injected content.

Affected Products

WordPress JB News Ticker plugin versions up to and including 1.0
WordPress sites permitting contributor-level user registration
WordPress installations using the jbticker shortcode

Discovery Timeline

2025-10-22 - CVE-2025-11804 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11804

Vulnerability Analysis

The JB News Ticker plugin registers a jbticker shortcode that accepts an id attribute controlled by the content author. The plugin renders this attribute value directly into HTML output without sanitizing input or escaping output. A contributor drafting a post can supply a crafted id value that breaks out of the intended attribute context and injects arbitrary script content.

Stored XSS in a WordPress shortcode is persistent. Once the payload is saved into post content, every subsequent render of that page returns the injected script to visitors. Attackers commonly leverage this to hijack administrator sessions, exfiltrate authentication cookies, or invoke privileged REST API actions from the victim's browser.

Root Cause

The root cause is missing input sanitization and missing output escaping on the id shortcode attribute in jb-plugin-hook.php. The plugin does not apply WordPress escaping helpers such as esc_attr() or esc_html() before emitting the attribute into the rendered HTML. Technical references are available in the WordPress plugin source at line 36 and line 45.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker inserts the jbticker shortcode with a malicious id attribute into a post or page. When any visitor renders the resulting page, the browser executes the attacker's JavaScript in the context of the site origin. No user interaction beyond visiting the page is required. Additional analysis is available in the Wordfence Vulnerability Analysis.

No public proof-of-concept exploit is currently listed for CVE-2025-11804, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-11804

Indicators of Compromise

Post or page content containing [jbticker id="..."] shortcodes with unusual characters such as quotes, angle brackets, javascript: URIs, or on*= event handlers inside the id attribute.
Unexpected <script> tags, iframes, or external resource loads originating from rendered pages that use the jbticker shortcode.
New or modified administrator accounts created shortly after a contributor-level user submitted content containing the shortcode.

Detection Strategies

Query the WordPress wp_posts table for post_content containing jbticker and inspect each id attribute value for HTML or JavaScript syntax.
Deploy a web application firewall rule that inspects POST bodies to /wp-admin/post.php for shortcode attributes containing script tags or event handler patterns.
Review browser Content Security Policy (CSP) violation reports for inline script executions on pages that embed the plugin's shortcode.

Monitoring Recommendations

Monitor contributor and author account activity, particularly post submissions and edits that include shortcodes.
Alert on WordPress role changes, plugin installations, and REST API calls initiated by browser sessions of administrative users.
Track outbound requests from rendered WordPress pages to unknown domains, which often indicate script-driven exfiltration.

How to Mitigate CVE-2025-11804

Immediate Actions Required

Deactivate the JB News Ticker plugin on all WordPress instances running version 1.0 or earlier until a patched release is verified.
Audit all existing posts and pages for the jbticker shortcode and remove or sanitize any suspicious id attribute values.
Rotate credentials and invalidate active sessions for administrator accounts that may have viewed injected pages.
Restrict contributor-level registration and review the list of accounts holding contributor privileges or higher.

Patch Information

At the time of NVD publication, no fixed version had been identified in the enriched CVE data. All versions up to and including 1.0 remain vulnerable. Monitor the WordPress plugin repository and the Wordfence advisory for a patched release, and update immediately once available.

Workarounds

Remove the JB News Ticker plugin entirely if the news ticker functionality is not essential.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure a web application firewall to block shortcode attribute values containing <, >, ", javascript:, or on event handler prefixes.
Limit publishing capabilities so that contributor submissions require editorial review before rendering on public pages.

bash

# Configuration example: locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[jbticker%' \
  AND post_status IN ('publish','draft','pending');"

# Deactivate the plugin via WP-CLI
wp plugin deactivate jb-news-ticker