CVE-2025-11812 Overview
CVE-2025-11812 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Reuse Builder plugin for WordPress in all versions up to and including 1.7. The flaw exists in the reuse_builder_single_post_title shortcode, which fails to properly sanitize input and escape output on the style attribute. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page.
Critical Impact
Authenticated contributors can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and further site compromise.
Affected Products
- WordPress Reuse Builder plugin, all versions through 1.7
- WordPress sites using the vulnerable reuse_builder_single_post_title shortcode
- Any site allowing contributor-level or higher untrusted accounts with this plugin installed
Discovery Timeline
- 2025-11-04 - CVE-2025-11812 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11812
Vulnerability Analysis
The vulnerability resides in the single_post_title.php shortcode handler inside the Reuse Builder plugin. The reuse_builder_single_post_title shortcode accepts a user-controlled style attribute that is rendered directly into the HTML output of a post or page. Because the plugin does not apply sufficient sanitization on input or escaping on output, an attacker can break out of the intended attribute context and inject arbitrary HTML or JavaScript.
Stored XSS is more impactful than reflected XSS because the payload persists in the database. Every visitor who loads the affected page executes the attacker's script. When an authenticated administrator visits the page, the payload runs with their session context, enabling cookie theft, forced actions via the REST API, or plugin installation leading to full site takeover.
Root Cause
The root cause is missing input sanitization and output escaping on the style shortcode attribute in shortcodes/single_post_title.php. WordPress provides helpers such as esc_attr() and wp_kses() to neutralize HTML control characters in attribute contexts, but the vulnerable code path emits the attacker-supplied style value without these safeguards.
Attack Vector
Exploitation requires an authenticated account with contributor privileges or higher. The attacker creates or edits a post containing the reuse_builder_single_post_title shortcode with a malicious style attribute that terminates the attribute context and appends JavaScript. Once the post is published or previewed, the injected script executes in the browser of every visitor who loads the page, including higher-privileged users. Refer to the Wordfence Vulnerability Report and the WordPress Reuse Builder Code for the vulnerable line.
Detection Methods for CVE-2025-11812
Indicators of Compromise
- Post or page content containing the reuse_builder_single_post_title shortcode with unusual characters in the style attribute such as ", >, <, or javascript:.
- Unexpected <script> tags, event handlers (onload, onerror, onmouseover), or external script references rendered on published pages.
- New or modified administrator accounts, plugin installations, or option changes shortly after contributor account activity.
Detection Strategies
- Query the wp_posts table for post_content values matching the reuse_builder_single_post_title shortcode combined with suspicious style values.
- Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts that include HTML control characters.
- Inspect rendered HTML of pages using the shortcode for injected script tags or malformed style attributes.
Monitoring Recommendations
- Alert on new posts or revisions submitted by contributor-level accounts that contain shortcode attributes with quote characters or angle brackets.
- Monitor for privilege changes, new administrator role assignments, and plugin/theme installations correlated with contributor activity.
- Deploy Content Security Policy (CSP) reporting to surface unexpected script execution across the WordPress front end.
How to Mitigate CVE-2025-11812
Immediate Actions Required
- Update the Reuse Builder plugin to a version newer than 1.7 as soon as a patched release is available from the vendor.
- If no patched version is available, deactivate and remove the plugin from all affected WordPress sites.
- Audit all existing posts and pages for the reuse_builder_single_post_title shortcode and remove any suspicious style attribute values.
Patch Information
As of the last NVD update on 2026-06-17, the vulnerability affects all versions up to and including 1.7. Monitor the WordPress Reuse Builder Plugin page for a fixed release. Review the Wordfence Vulnerability Report for updated remediation guidance.
Workarounds
- Restrict contributor and author role assignments to trusted users only until the plugin is patched.
- Use a web application firewall (WAF) rule to block requests containing the reuse_builder_single_post_title shortcode with quote or angle bracket characters in the style attribute.
- Apply a strict Content Security Policy that disallows inline scripts and unapproved script sources to reduce the impact of injected payloads.
# Configuration example: identify posts using the vulnerable shortcode
wp post list --format=ids --s='reuse_builder_single_post_title' \
| xargs -I {} wp post get {} --field=post_content
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
