CVE-2025-11859: PayPal Donation Shortcode XSS Vulnerability

CVE-2025-11859 Overview

CVE-2025-11859 is a Stored Cross-Site Scripting (XSS) vulnerability in the PayPal Donation Shortcode plugin for WordPress. The flaw affects all versions up to and including 0.1. The plugin fails to properly sanitize and escape the title and text parameters of the paypal shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into WordPress pages. The injected scripts execute in the browser of any visitor who views the affected page. The issue is classified as Improper Neutralization of Input During Web Page Generation [CWE-79].

Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes in the context of any user, including administrators, enabling session theft and account takeover.

Affected Products

PayPal Donation Shortcode plugin for WordPress, all versions through 0.1
WordPress sites permitting contributor-level or higher registration
Any site rendering pages that contain the paypal shortcode

Discovery Timeline

2025-11-11 - CVE-2025-11859 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11859

Vulnerability Analysis

The vulnerability resides in the shortcode handler registered by the PayPal Donation Shortcode plugin. When WordPress renders a page containing the paypal shortcode, the handler reads user-supplied title and text attributes and inserts them directly into the HTML output. Because the plugin performs neither input sanitization nor output escaping, any HTML or JavaScript supplied in these attributes is rendered as active markup. An authenticated contributor can save a post that includes a crafted shortcode. The payload persists in the database and executes every time a visitor loads the page. The stored nature of the flaw allows attackers to target administrators who review pending content, enabling privilege escalation through session or cookie theft. Technical implementation details are available in the WordPress plugin source and the Wordfence Vulnerability Report.

Root Cause

The root cause is the absence of sanitization routines such as sanitize_text_field() on input and escaping routines such as esc_attr() or esc_html() on output. Attributes passed to the shortcode are concatenated into HTML without validation.

Attack Vector

An attacker authenticates to WordPress with contributor-level access, then creates or edits a post containing a paypal shortcode with malicious title or text attribute values. The payload is stored in the WordPress database and served to every subsequent viewer of the affected page.

No verified proof-of-concept code has been published. Refer to the linked advisories for technical detail.

Detection Methods for CVE-2025-11859

Indicators of Compromise

WordPress posts or pages containing paypal shortcode attributes with <script>, onerror, onload, or javascript: values
Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages with the paypal shortcode
New or modified content authored by low-privilege contributor accounts that includes the paypal shortcode

Detection Strategies

Query the wp_posts table for post_content values matching [paypal combined with HTML event handlers or <script tags
Review web server access logs for requests to pages containing the shortcode that originate unexpected JavaScript execution
Enable WordPress audit logging to record post edits by contributor and author accounts

Monitoring Recommendations

Monitor administrative sessions for anomalous cookie use, especially when reviewing pending content from contributors
Alert on installations of the paypal-donation-shortcode plugin across managed WordPress fleets
Track browser Content Security Policy (CSP) violation reports for inline script execution originating from CMS-rendered pages

How to Mitigate CVE-2025-11859

Immediate Actions Required

Deactivate and remove the PayPal Donation Shortcode plugin until a patched version is released
Audit existing posts and pages for the paypal shortcode and remove entries containing script payloads
Review contributor and author accounts, disabling any that appear untrusted or unused

Patch Information

No patched version has been published at the time of writing. Version 0.1 remains the latest release, and the vendor has not issued a fix. Site owners should replace the plugin with a maintained alternative that properly escapes shortcode attributes.

Workarounds

Restrict post creation privileges by removing the contributor role from untrusted users
Deploy a web application firewall (WAF) rule that blocks shortcode input containing <script, onerror=, or javascript: patterns
Implement a strict Content Security Policy that disallows inline JavaScript execution
Use an editorial workflow that renders untrusted content in an isolated preview environment before publication

bash

# Configuration example: locate and disable the vulnerable plugin
wp plugin deactivate paypal-donation-shortcode
wp plugin delete paypal-donation-shortcode

# Search database for suspicious shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[paypal%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%');"