CVE-2025-11823 Overview
CVE-2025-11823 is a Stored Cross-Site Scripting (XSS) vulnerability in the ShopLentor plugin for WordPress, marketed as WooCommerce Builder for Elementor & Gutenberg with 21+ modules. The flaw affects all versions of the plugin (also known as woolentor-addons) up to and including 3.2.4. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts through the button_exist_text parameter of the wishsuite_button shortcode. The injected payload executes in the browser of any visitor who loads the affected page. The vulnerability is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.
Critical Impact
Authenticated contributors can persistently store JavaScript that runs against site visitors and administrators, enabling session theft, account takeover, and content manipulation.
Affected Products
- Hasthemes ShopLentor (woolentor-addons) versions up to and including 3.2.4
- WordPress sites using the WishSuite wishlist module with the wishsuite_button shortcode
- Deployments allowing Contributor-level or higher user registration
Discovery Timeline
- 2025-10-25 - CVE-2025-11823 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11823
Vulnerability Analysis
The vulnerability resides in the ShopLentor WishSuite module, specifically in the shortcode handler wishsuite_button. When the shortcode is rendered, the button_exist_text parameter is passed to the template wishsuite-button-exist.php without sufficient sanitization or output escaping. As a result, any HTML or JavaScript supplied through the attribute is emitted directly into the page markup.
Because the payload is stored inside post or page content, the attack persists across sessions and executes for every visitor who loads the affected page. The scope change reflected in the CVSS vector indicates that a Contributor-level actor can affect resources beyond their own privilege boundary, including administrator sessions rendered in the same origin. This aligns with the plugin's role as a front-end builder where shortcodes are commonly embedded by lower-privileged authors.
Root Cause
The root cause is missing input sanitization and missing output escaping around the button_exist_text shortcode attribute. Standard WordPress hardening functions such as esc_attr(), esc_html(), or wp_kses() are not applied before the value is rendered into the DOM. The relevant source is visible in the Woolentor Addons Shortcode File and the corresponding Woolentor Addons Template File.
Attack Vector
An attacker first obtains Contributor-level access, either through open registration, a compromised low-privilege account, or social engineering. The attacker then creates or edits a post containing the wishsuite_button shortcode and injects a malicious payload into the button_exist_text attribute. When any user, including an administrator previewing the submission, loads the rendered page, the script executes in their browser context. Post-exploitation activity typically includes stealing authentication cookies, performing actions on behalf of privileged users through forged requests, and pivoting to broader site compromise. See the Wordfence Vulnerability Analysis for additional detail.
No verified proof-of-concept code is available in the referenced sources. The exploitation mechanism is described here in prose only.
Detection Methods for CVE-2025-11823
Indicators of Compromise
- Post or page content containing the [wishsuite_button] shortcode with unusual button_exist_text attribute values, particularly strings containing <script, onerror=, onload=, or javascript:.
- Contributor or Author accounts creating or editing posts that reference WishSuite shortcodes when the site does not otherwise use the wishlist feature.
- Outbound browser requests from administrator sessions to unfamiliar domains shortly after previewing user-submitted content.
Detection Strategies
- Query the wp_posts table for post_content values matching the wishsuite_button shortcode combined with script-related tokens in the button_exist_text parameter.
- Review web server logs for POST requests to /wp-admin/post.php and /wp-admin/post-new.php originating from Contributor accounts that include shortcode payloads.
- Monitor Content Security Policy (CSP) violation reports for inline script blocks executing on pages authored by non-administrator users.
Monitoring Recommendations
- Audit WordPress user roles regularly and alert on new Contributor or Author account creation, especially when registration is open.
- Enable file integrity monitoring on the wp-content/plugins/woolentor-addons/ directory to detect tampering with plugin files.
- Forward WordPress audit logs to a centralized SIEM and alert on post revisions that introduce shortcode attributes containing HTML tag characters.
How to Mitigate CVE-2025-11823
Immediate Actions Required
- Update the ShopLentor plugin to a version later than 3.2.4 as soon as a fixed release is available from Hasthemes.
- If a patched version is not yet installed, disable the WishSuite module within ShopLentor settings or deactivate the plugin entirely on production sites.
- Review existing posts and pages for wishsuite_button shortcodes and remove any suspicious button_exist_text attribute values.
- Rotate credentials and invalidate active sessions for administrators who may have previewed content authored by untrusted contributors.
Patch Information
The vulnerability affects all versions up to and including 3.2.4. Administrators should consult the Wordfence Vulnerability Analysis and the WordPress plugin repository for the latest fixed release and changelog entries.
Workarounds
- Restrict Contributor-level registration and require administrator approval for any new low-privilege accounts.
- Deploy a Web Application Firewall (WAF) rule that blocks shortcode attributes containing <script, on*= event handlers, or javascript: URIs in POST bodies to wp-admin endpoints.
- Implement a strict Content Security Policy that disallows inline scripts on public-facing pages to reduce the impact of stored XSS.
- Remove the WishSuite module if the wishlist functionality is not required for the site.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
