CVE-2025-11806: Qzzr Shortcode Plugin XSS Vulnerability

CVE-2025-11806 Overview

CVE-2025-11806 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Qzzr Shortcode plugin for WordPress. The flaw affects all versions up to and including 1.0.1. The plugin fails to sanitize input and escape output on the quiz attribute of the qzzr shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into posts and pages. The injected scripts execute in the browser of any visitor who views the affected content.

Critical Impact
Attackers with contributor accounts can persist JavaScript payloads in WordPress content, enabling session theft, account takeover, and drive-by attacks against site visitors and administrators.

Affected Products

Qzzr Shortcode plugin for WordPress, all versions up to and including 1.0.1
WordPress sites permitting contributor-or-higher registration
WordPress installations using the qzzr shortcode in published content

Discovery Timeline

2025-10-31 - CVE-2025-11806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11806

Vulnerability Analysis

The Qzzr Shortcode plugin registers the qzzr shortcode to embed Qzzr quizzes in WordPress posts and pages. The shortcode accepts a quiz attribute that is passed into HTML output without adequate sanitization or escaping. An authenticated user with the contributor role can craft shortcode markup that breaks out of the intended attribute context and injects arbitrary JavaScript.

Because the payload is stored in post content, execution occurs on every subsequent page view. Any authenticated administrator who previews or reviews the contributor's submission executes the payload in their session context. This enables session token theft, forced administrative actions via the WordPress REST API, and pivoting to privilege escalation. The stored nature of the flaw makes it well suited to persistent watering-hole style attacks against site staff.

Root Cause

The root cause is missing input sanitization on the quiz shortcode attribute and missing output escaping when the attribute value is rendered into the HTML response. The shortcode handler in qzzr.php concatenates the attribute directly into the emitted markup. WordPress functions such as esc_attr() or sanitize_text_field() are not applied.

Attack Vector

Exploitation requires an authenticated account with at least the contributor role. The attacker creates or edits a post containing a qzzr shortcode with a malicious quiz attribute value. When the post is viewed, previewed, or moderated, the injected script executes in the visitor's browser under the site's origin. No user interaction beyond viewing the page is required, and the attack traverses a scope change from contributor input to administrator execution.

See the Wordfence Vulnerability Report and the vulnerable source in the WordPress Plugin Qzzr Shortcode trac for technical details.

Detection Methods for CVE-2025-11806

Indicators of Compromise

Post or page revisions containing [qzzr quiz="..."] shortcodes with <script>, onerror=, onload=, or javascript: sequences in the attribute value
Unexpected outbound requests from visitor browsers to attacker-controlled domains referenced in rendered post HTML
New or modified administrator accounts, user role changes, or plugin installations following contributor content publication
WordPress audit log entries showing contributor accounts editing posts that contain the qzzr shortcode

Detection Strategies

Query the wp_posts table for post_content values matching the qzzr shortcode combined with HTML event handlers or script tags
Deploy a web application firewall rule that inspects POST requests to /wp-admin/post.php and /wp-json/wp/v2/posts for script payloads inside shortcode attributes
Monitor server logs for anomalous authenticated POST activity from contributor accounts followed by administrator page views

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions on WordPress pages
Alert on WordPress role changes, new administrator creation, and plugin or theme file writes
Track logins from contributor accounts that are followed by unexpected privilege escalation events

How to Mitigate CVE-2025-11806

Immediate Actions Required

Deactivate the Qzzr Shortcode plugin on all WordPress sites until a patched version is available
Audit existing posts and pages for qzzr shortcodes containing suspicious attribute content and remove offending entries
Restrict contributor and author registration on public-facing WordPress sites, and review recent contributor account activity
Rotate credentials and session tokens for administrators who may have viewed affected content

Patch Information

No fixed version has been published at the time of NVD listing. All versions through 1.0.1 remain vulnerable. Monitor the WordPress Qzzr Shortcode plugin page for an updated release, and consult the Wordfence Vulnerability Report for remediation updates.

Workarounds

Remove or replace the plugin with a maintained alternative that properly escapes shortcode attributes
Deploy a web application firewall rule that blocks <, >, and javascript: characters within the quiz attribute of the qzzr shortcode
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit content submission privileges to trusted users and require editor review before publication

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate qzzr-shortcode
wp plugin delete qzzr-shortcode

# Search post content for suspicious qzzr shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%[qzzr%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');"