CVE-2025-11809: WP-Force Images Download Plugin XSS Flaw

CVE-2025-11809 Overview

CVE-2025-11809 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-Force Images Download plugin for WordPress. The flaw affects all plugin versions up to and including 1.8. The vulnerability resides in the wpfid shortcode, which fails to properly sanitize input and escape output on the class attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any user who visits the compromised page. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated contributors can inject persistent JavaScript that executes in the context of any visitor, including administrators, enabling session theft and administrative account takeover.

Affected Products

• WP-Force Images Download plugin for WordPress, versions up to and including 1.8
• WordPress sites permitting contributor-level user registration
• Any WordPress installation rendering the wpfid shortcode on public pages

Discovery Timeline

• 2025-10-22 - CVE-2025-11809 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11809

Vulnerability Analysis

The WP-Force Images Download plugin registers a WordPress shortcode named wpfid. When WordPress renders a post or page containing this shortcode, the plugin processes user-supplied attributes, including a class attribute intended for CSS styling. The plugin writes the attribute value directly into the HTML output without applying WordPress escaping functions such as esc_attr(). An authenticated user with contributor privileges can craft shortcode input that breaks out of the attribute context and injects arbitrary HTML or JavaScript. The injected payload persists in the database and executes each time the page is rendered in a browser.

Root Cause

The root cause is missing input sanitization and output escaping in the shortcode handler located in wp_fid.php. WordPress provides standard functions for these operations, including sanitize_html_class() for class values and esc_attr() for attribute output. The vulnerable code path in wp_fid.php line 155 concatenates attacker-controlled input directly into the response.

Attack Vector

Exploitation requires authenticated access at the contributor role or higher. WordPress contributors can create draft posts but cannot publish them without editorial review. An attacker submits a post or page containing the wpfid shortcode with a malicious class attribute. Once an editor or administrator previews or publishes the content, the payload executes in their browser session. Successful exploitation can lead to session cookie theft, administrative action forgery, or redirection to malicious infrastructure. The vulnerability requires no user interaction beyond visiting the affected page.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-11809

Indicators of Compromise

• Posts or pages containing wpfid shortcodes with unusual class attribute values containing quotes, angle brackets, or javascript: strings
• Database entries in wp_posts.post_content with encoded script fragments adjacent to [wpfid shortcode tokens
• Unexpected outbound HTTP requests from administrator browsers to unfamiliar domains after visiting content pages
• New administrator accounts or modified user roles created outside normal workflows

Detection Strategies

• Query the WordPress database for posts containing [wpfid combined with <script, onerror=, or onload= patterns
• Deploy a Web Application Firewall (WAF) rule to inspect shortcode attributes for HTML tag characters and event handlers
• Review WordPress audit logs for contributor accounts creating or editing posts containing the wpfid shortcode
• Monitor plugin file integrity to identify installations running the vulnerable 1.8 or earlier codebase

Monitoring Recommendations

• Enable browser Content Security Policy (CSP) reporting to capture inline script execution attempts
• Alert on privilege changes, new administrative users, and unexpected REST API activity following content publication
• Correlate WordPress access logs with contributor login events and subsequent editor session activity

How to Mitigate CVE-2025-11809

Immediate Actions Required

• Update the WP-Force Images Download plugin to a version newer than 1.8 once the vendor publishes a patched release
• Audit all contributor and author accounts and remove or downgrade unnecessary privileges
• Review existing posts and pages for wpfid shortcode usage and inspect attribute contents for injected payloads
• Rotate administrator credentials and invalidate active sessions if suspicious content is discovered

Patch Information

Monitor the WordPress plugin change log for a fixed release. A remediated version must apply sanitize_html_class() or esc_attr() to shortcode attributes before rendering them into the HTML response.

Workarounds

• Deactivate and remove the WP-Force Images Download plugin until a patched version is available
• Restrict contributor role assignments and require editorial review of all draft content before preview
• Deploy a WAF rule that blocks shortcode attributes containing <, >, ", or event handler substrings
• Implement a strict Content Security Policy that disallows inline script execution on the site

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate wp-force-images-download
wp plugin delete wp-force-images-download