CVE-2025-11818: WP Responsive Meet The Team XSS Vulnerability

CVE-2025-11818 Overview

CVE-2025-11818 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Responsive Meet The Team plugin for WordPress. The flaw affects all versions up to and including 1.0.1 and stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the wprm_team shortcode. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users who view the affected pages. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level attackers can inject persistent JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced administrative actions, and browser-based redirection.

Affected Products

WP Responsive Meet The Team plugin for WordPress (all versions ≤ 1.0.1)
WordPress sites using the vulnerable wprm_team shortcode
Any WordPress installation permitting contributor-level user registration with the plugin enabled

Discovery Timeline

2025-10-22 - CVE-2025-11818 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11818

Vulnerability Analysis

The vulnerability resides in the plugin's handling of shortcode attributes for wprm_team. When a contributor or higher-privileged user embeds the shortcode in a post or page, the plugin accepts user-supplied attributes and renders them into the resulting HTML without adequate sanitization or output escaping. The injected content is stored in the WordPress database and executes each time a visitor loads the affected page. Because the payload is persistent, every visitor to the compromised page becomes a potential victim, including administrators whose sessions can be leveraged for privilege escalation. The relevant plugin source is documented in the WordPress Plugin Code Reference and further analyzed in the Wordfence Vulnerability Analysis.

Root Cause

The plugin fails to apply WordPress sanitization APIs such as sanitize_text_field() on incoming shortcode attributes and does not escape output using functions like esc_attr() or esc_html() prior to rendering. This omission allows raw HTML and JavaScript to reach the browser as executable content within the page markup.

Attack Vector

An authenticated attacker with contributor-level access authors a post containing the wprm_team shortcode with a malicious attribute value that includes JavaScript. Once the post is published or previewed by another user, the injected script executes in the victim's browser session under the site's origin. Attackers can use this to steal session cookies, perform actions on behalf of administrators, redirect users to attacker-controlled infrastructure, or deliver drive-by malware.

No verified public exploit code is available. The vulnerability mechanism is described in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2025-11818

Indicators of Compromise

Posts or pages containing wprm_team shortcodes with attribute values that include <script> tags, javascript: URIs, or HTML event handlers such as onerror and onclick.
Unexpected outbound HTTP requests from browsers loading pages that use the plugin.
New or modified posts authored by contributor-level accounts referencing the plugin's shortcodes.

Detection Strategies

Query the wp_posts table for post_content containing wprm_team combined with suspicious substrings such as <script, onerror=, or javascript:.
Review WordPress audit logs for contributor accounts creating or editing posts that embed the plugin's shortcode.
Deploy a web application firewall rule that inspects POST bodies to /wp-admin/post.php for shortcode attribute values containing script-like content.

Monitoring Recommendations

Monitor creation of new contributor-level accounts and correlate with subsequent shortcode usage.
Alert on Content Security Policy (CSP) violation reports originating from pages that render the plugin output.
Track plugin version inventory across WordPress fleets to identify sites still running versions ≤ 1.0.1.

How to Mitigate CVE-2025-11818

Immediate Actions Required

Deactivate and remove the WP Responsive Meet The Team plugin until a patched release is confirmed by the vendor.
Audit all existing posts and pages for wprm_team shortcode usage and remove or sanitize any suspicious attribute values.
Restrict contributor-level account creation and review existing contributor accounts for legitimacy.

Patch Information

At the time of publication, no fixed version is listed for versions above 1.0.1. Administrators should monitor the official plugin page for an updated release and apply it as soon as it becomes available.

Workarounds

Remove the plugin from production sites until a vendor patch is released.
Implement a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
Deploy a web application firewall with rules that block script tags and event handler attributes in shortcode parameters submitted to the WordPress editor.
Revoke or downgrade unnecessary contributor-level accounts to prevent authenticated exploitation.

bash

# Example: locate posts containing the vulnerable shortcode via WP-CLI
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[wprm_team%' \
  AND (post_content LIKE '%<script%' \
       OR post_content LIKE '%onerror=%' \
       OR post_content LIKE '%javascript:%');

# Deactivate the plugin fleet-wide
wp plugin deactivate wp-responsive-meet-the-team