CVE-2025-11867: Bg Book Publisher Plugin XSS Vulnerability

CVE-2025-11867 Overview

CVE-2025-11867 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Bg Book Publisher plugin for WordPress. The flaw affects all versions up to and including 1.25. The plugin fails to properly escape the book_author post meta value before rendering it through the [book_author] shortcode. Authenticated users with contributor-level privileges or higher can inject arbitrary JavaScript. The injected script executes in the browser of any visitor who views an affected page.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, redirection, and administrative action hijacking.

Affected Products

Bg Book Publisher plugin for WordPress — all versions through 1.25
WordPress sites allowing contributor-level user registration
Any WordPress installation rendering the [book_author] shortcode

Discovery Timeline

2025-10-22 - CVE-2025-11867 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-11867

Vulnerability Analysis

The Bg Book Publisher plugin exposes a [book_author] shortcode that renders the book_author custom post meta value directly into page HTML. The plugin does not apply output escaping functions such as esc_html() or esc_attr() to this value. Any contributor who edits a post can set the book_author meta to a payload containing <script> tags or event handler attributes. When the shortcode renders on a public page, the browser executes the attacker-controlled script in the context of the site origin.

The vulnerability requires authenticated access at the contributor level or higher, which lowers the barrier compared to anonymous XSS but still requires a valid account. Because the payload persists in the WordPress database, every visitor to the affected page triggers execution. Impact includes administrator session hijacking, forced actions through the WordPress REST API, and client-side redirection to malicious infrastructure.

Root Cause

The root cause is missing output encoding in the shortcode handler at bg_bpub.php line 121. The plugin retrieves the book_author post meta with get_post_meta() and emits the raw string into the DOM without sanitization or context-aware escaping. See the WordPress Plugin Code Reference for the vulnerable code path.

Attack Vector

An authenticated contributor creates or edits a post, submits a malicious payload into the book_author post meta field, and places the [book_author] shortcode in post content. Once the post is reviewed or published, the shortcode output triggers the stored script against every subsequent viewer. Full technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11867

Indicators of Compromise

Post meta entries named book_author containing <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound requests from visitor browsers to attacker-controlled domains
New administrator accounts or modified user roles following contributor activity
WordPress audit log entries showing contributor edits to posts containing the [book_author] shortcode

Detection Strategies

Query the wp_postmeta table for meta_key = 'book_author' and inspect values for HTML or JavaScript syntax
Deploy a Web Application Firewall rule to flag POST requests to wp-admin/post.php containing script payloads in meta fields
Review web server logs for anomalous referrer chains originating from pages rendering the [book_author] shortcode

Monitoring Recommendations

Monitor contributor-level account activity, including post creation and meta field updates
Alert on Content Security Policy (CSP) violation reports originating from WordPress-rendered pages
Track changes to installed plugin versions and compare against the patched release once published

How to Mitigate CVE-2025-11867

Immediate Actions Required

Deactivate the Bg Book Publisher plugin until a patched version is released and installed
Audit all existing book_author post meta values and remove any entries containing HTML or JavaScript
Restrict contributor-level account registration and review existing contributor accounts for legitimacy
Rotate administrator session cookies and credentials if suspicious contributor activity is identified

Patch Information

As of the last NVD update on 2026-10-08, no fixed version beyond 1.25 is listed in the enriched data. Monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an updated release that applies proper escaping to the book_author meta value.

Workarounds

Remove the [book_author] shortcode from all published pages and posts until a patch is available
Implement a strict Content Security Policy that disallows inline scripts to limit XSS payload execution
Downgrade contributor accounts to subscriber role where posting privileges are not required
Apply a virtual patch via a WAF rule that strips HTML tags from book_author meta values on save

bash

# Example: locate suspicious book_author meta entries via WP-CLI
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key = 'book_author' \
  AND (meta_value LIKE '%<script%' \
       OR meta_value LIKE '%onerror=%' \
       OR meta_value LIKE '%javascript:%');"