CVE-2025-11857: XX2WP Integration Tools XSS Vulnerability

CVE-2025-11857 Overview

CVE-2025-11857 is a Stored Cross-Site Scripting (XSS) vulnerability in the XX2WP Integration Tools (also known as fb2wp-integration-tools) plugin for WordPress. The flaw exists in the mxp_fb2wp_display_embed shortcode handler, which fails to sanitize input and escape output for the post_id parameter. All plugin versions up to and including 1.9.9 are affected. Authenticated users with contributor-level permissions or higher can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The weakness is classified as CWE-79.

Critical Impact
Authenticated contributors can persistently inject JavaScript into WordPress pages, enabling session theft, administrative account takeover, and redirection of site visitors.

Affected Products

XX2WP Integration Tools (fb2wp-integration-tools) plugin for WordPress
All versions up to and including 1.9.9
WordPress sites allowing contributor-level or higher accounts

Discovery Timeline

2025-10-18 - CVE-2025-11857 published to the National Vulnerability Database (NVD)
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2025-11857

Vulnerability Analysis

The vulnerability resides in the plugin's shortcode handler mxp_fb2wp_display_embed, defined in index.php around line 302 of the 1.9.9 release. Shortcodes in WordPress accept user-supplied attributes that are rendered into post or page HTML output. In this case, the post_id attribute passed into the shortcode is reflected into the generated markup without proper sanitization or escaping.

Because the injected payload is stored inside the post content, any visitor who later renders the page triggers the script. Successful exploitation can lead to session cookie theft, forced actions against authenticated administrators, drive-by redirects, and SEO poisoning. Contributor accounts cannot normally publish content directly, but the stored payload persists in drafts and executes when editors or administrators preview or publish the submission.

Root Cause

The root cause is missing input sanitization and output escaping on the post_id shortcode attribute. WordPress provides functions such as sanitize_text_field(), absint(), and esc_attr() to safely process shortcode input, but the vulnerable handler emits the attribute value directly into the HTML response. This is a textbook instance of improper neutralization of input during web page generation.

Attack Vector

An attacker authenticated as a contributor (or higher) creates or edits a post that includes the mxp_fb2wp_display_embed shortcode with a malicious post_id attribute containing JavaScript. The attacker submits the post for review. When an administrator or any site visitor later renders the content, the shortcode handler emits the attacker-controlled string into the DOM, and the browser executes it in the context of the WordPress site.

The privilege scope changes during exploitation, meaning the attacker leverages contributor-level access to compromise higher-privileged user sessions. Technical details of the vulnerable code are available via the WordPress FB2WP Tool Code reference and the Wordfence Vulnerability Intel entry.

Detection Methods for CVE-2025-11857

Indicators of Compromise

Posts, pages, or drafts containing the [mxp_fb2wp_display_embed] shortcode with unusual post_id values that include <script>, onerror=, javascript:, or encoded HTML.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing contributor-submitted content.
New administrator accounts, modified user roles, or plugin/theme changes shortly after a contributor submission is reviewed.

Detection Strategies

Query the wp_posts table for post_content entries matching the vulnerable shortcode and inspect the post_id attribute for non-numeric content.
Deploy a web application firewall (WAF) rule to flag shortcode attributes containing HTML metacharacters or script keywords.
Review WordPress audit logs for contributors submitting content containing shortcode markup, especially around the time new users were elevated.

Monitoring Recommendations

Monitor WordPress file integrity on wp-content/plugins/fb2wp-integration-tools/ to confirm patched versions remain in place.
Alert on anomalous administrative actions following preview or publish events on contributor-authored posts.
Ingest WordPress and web server logs into a centralized data lake and correlate authenticated contributor sessions with JavaScript-based response payloads.

How to Mitigate CVE-2025-11857

Immediate Actions Required

Update the XX2WP Integration Tools plugin to a version later than 1.9.9 as soon as the vendor publishes a patched release.
Audit all existing contributor and author submissions for the mxp_fb2wp_display_embed shortcode and remove or sanitize suspicious entries.
Rotate credentials for administrator and editor accounts that previewed contributor content while the vulnerable plugin was active.

Patch Information

The plugin repository tracks fix activity through the WordPress Plugin Directory. Review the WordPress FB2WP ChangeSet for the current remediation state and apply the latest release that addresses CVE-2025-11857. If no fixed version is yet available, deactivate and remove the plugin until one is published.

Workarounds

Deactivate the XX2WP Integration Tools plugin until an updated version addressing CVE-2025-11857 is installed.
Restrict contributor and author roles on untrusted sites, and require editorial review of raw post content before approval.
Deploy a WAF ruleset that blocks shortcode attributes containing <, >, ", or javascript: in POST bodies submitted to /wp-admin/post.php.

bash

# Example WP-CLI commands to disable the vulnerable plugin and search for injected shortcodes
wp plugin deactivate fb2wp-integration-tools
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%mxp_fb2wp_display_embed%' \
  AND post_content REGEXP 'post_id=\"[^0-9\"]';"