CVE-2025-11875: WordPress SpendeOnline.org Plugin XSS Flaw

CVE-2025-11875 Overview

CVE-2025-11875 is a Stored Cross-Site Scripting (XSS) vulnerability in the SpendeOnline.org plugin for WordPress. The flaw affects all versions up to and including 3.0.1 and stems from insufficient input sanitization and output escaping on user-supplied attributes passed to the plugin's spendeonline shortcode. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The issue is tracked under CWE-79.

Critical Impact
Contributor-level attackers can inject persistent JavaScript into published pages, enabling session theft, credential harvesting, and redirection of site visitors — including administrators.

Affected Products

SpendeOnline.org plugin for WordPress, versions ≤ 3.0.1
WordPress sites accepting contributor-level (or higher) registrations that use the spendeonline shortcode
Any content rendering pipeline that outputs the shortcode's attributes unescaped

Discovery Timeline

2025-10-25 - CVE-2025-11875 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11875

Vulnerability Analysis

The SpendeOnline.org plugin registers a WordPress shortcode named spendeonline that accepts user-supplied attributes. According to the plugin source review, these attributes are concatenated into HTML output without adequate sanitization or context-aware escaping. As a result, an attacker who can author posts or pages can embed the shortcode with attribute values containing JavaScript, and the malicious payload is stored in the WordPress database.

When a visitor loads a page containing the poisoned shortcode, the browser parses the injected markup and executes attacker-controlled scripts in the site's origin. Because contributor accounts on many WordPress sites are self-service or lightly vetted, the barrier to exploitation is low. The scope-changed CVSS vector reflects that the injected code affects users beyond the contributor who authored the content.

Root Cause

The root cause is missing input sanitization on shortcode attributes and missing output escaping when those attributes are rendered into HTML. WordPress provides helpers such as sanitize_text_field(), esc_attr(), and esc_html() for this purpose, but the vulnerable code paths bypass them. A remediation changeset has been published by the plugin maintainer.

Attack Vector

Exploitation requires an authenticated account with at least contributor privileges. The attacker creates or edits a post containing the spendeonline shortcode with a crafted attribute value that closes the intended HTML context and introduces a <script> block or an event handler such as onerror. Once the post is viewed — typically after publication or preview by an editor or administrator — the payload executes in the victim's session, enabling cookie exfiltration, forced administrative actions via authenticated requests, or drive-by redirection.

See the Wordfence vulnerability report for additional technical context.

Detection Methods for CVE-2025-11875

Indicators of Compromise

Posts or postmeta rows containing the spendeonline shortcode with attribute values that include <script, javascript:, onerror=, onload=, or encoded variants
Outbound requests from site visitors to unfamiliar domains shortly after loading pages that use the shortcode
Unexpected administrator account creation, password resets, or plugin installations following contributor content publication

Detection Strategies

Query the wp_posts table for post_content matching the spendeonline shortcode and inspect attribute values for HTML control characters or script keywords
Enable and review WordPress audit logging for content authored by contributor-level accounts, especially newly registered ones
Deploy a Content Security Policy in report-only mode to surface inline script violations originating from post content

Monitoring Recommendations

Monitor web server access logs for anomalous request patterns from authenticated sessions following page views
Alert on newly created contributor or author accounts, particularly those that publish content containing shortcodes shortly after registration
Track plugin version inventory across managed WordPress fleets to identify hosts still running SpendeOnline.org ≤ 3.0.1

How to Mitigate CVE-2025-11875

Immediate Actions Required

Update the SpendeOnline.org plugin to a version newer than 3.0.1 that includes the sanitization fix from the referenced changeset
Audit existing posts and pages for the spendeonline shortcode and remove or sanitize any attribute values containing HTML or JavaScript
Review contributor and author accounts, revoking access for unrecognized users and rotating credentials for shared accounts

Patch Information

The plugin maintainer has published a fix via the WordPress plugin repository. Administrators should upgrade to the patched release referenced in the WordPress changeset. After upgrading, clear any page and object caches to ensure stored payloads are re-rendered by the sanitized code path — though database cleanup remains necessary because escaping at render time will not remove pre-existing malicious content already stored in post_content.

Workarounds

Temporarily deactivate the SpendeOnline.org plugin until the patched version can be deployed
Restrict contributor-level publishing by requiring editor approval before posts are made publicly viewable
Deploy a strict Content Security Policy that disallows inline scripts and untrusted external script sources to blunt XSS payloads
Apply a web application firewall rule that blocks requests containing script tags or JavaScript event handlers within shortcode attributes

bash

# Example: search WordPress database for potentially malicious shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content REGEXP '\\[spendeonline[^]]*(<script|javascript:|onerror=|onload=)'"