CVE-2025-11878 Overview
The ST Categories Widget plugin for WordPress contains a stored cross-site scripting vulnerability in versions up to and including 1.0.0. The flaw resides in the plugin's st-categories shortcode, which fails to sanitize input or escape output on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript that executes when a visitor loads the affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Stored XSS enables session hijacking, credential theft, and administrative account takeover when a privileged user views an injected page.
Affected Products
- ST Categories Widget plugin for WordPress
- All versions less than or equal to 1.0.0
- Sites permitting contributor-level accounts or higher
Discovery Timeline
- 2025-10-22 - CVE-2025-11878 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11878
Vulnerability Analysis
The ST Categories Widget plugin exposes a [st-categories] shortcode that accepts user-controlled attributes. The plugin passes these attributes into rendered HTML without applying WordPress sanitization primitives such as sanitize_text_field() or output-escaping functions like esc_attr() and esc_html(). As a result, an attacker with post-editing rights can embed the shortcode with malicious attribute values in a post or page. When another user opens the rendered page, the injected script executes in that user's browser session.
The stored nature of the flaw means payloads persist in the database and re-execute on every page view. An administrator visiting an injected post triggers script execution with administrator privileges in the browser context, enabling account takeover through cookie exfiltration or forced administrative actions via authenticated fetch requests.
Root Cause
The root cause is insufficient input sanitization and output escaping in the shortcode handler defined around line 176 of st-categories-wp.php. Attribute values reach the DOM without neutralization of HTML control characters. See the WordPress Plugin Code Reference for the affected source.
Attack Vector
Exploitation requires an authenticated account with contributor-level access or higher. The attacker inserts the [st-categories] shortcode with a crafted attribute containing HTML or JavaScript, then submits or publishes the post. Any user visiting the resulting page executes the payload in their browser. For technical detail see the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-11878
Indicators of Compromise
- Posts or pages containing the [st-categories] shortcode with unusual attribute values that include <script>, on*= event handlers, or javascript: URIs.
- Unexpected outbound requests from browsers loading WordPress content to attacker-controlled domains.
- New administrative accounts or role changes originating from sessions that recently viewed content containing the shortcode.
Detection Strategies
- Query the wp_posts table for post_content values containing st-categories alongside HTML control characters or scheme prefixes such as javascript:.
- Review WordPress audit logs for contributor-level account edits creating or modifying posts that embed the shortcode.
- Deploy web application firewall rules that inspect shortcode attribute payloads for script tags and event handlers.
Monitoring Recommendations
- Monitor authenticated POST requests to /wp-admin/post.php and /wp-admin/post-new.php for shortcode attribute anomalies.
- Alert on browser Content Security Policy violations reported from WordPress-hosted pages.
- Track privileged administrator sessions that access contributor-authored draft content.
How to Mitigate CVE-2025-11878
Immediate Actions Required
- Deactivate the ST Categories Widget plugin until a patched release is available.
- Audit all posts and pages containing the [st-categories] shortcode and remove suspicious attribute values.
- Review contributor and author accounts for signs of compromise and rotate credentials where warranted.
Patch Information
At the time of publication, the NVD entry lists all versions of the ST Categories Widget plugin up to and including 1.0.0 as vulnerable. Administrators should monitor the Wordfence Vulnerability Report and the plugin's WordPress.org page for a fixed release.
Workarounds
- Restrict contributor and author role assignments to trusted users only.
- Configure a strict Content Security Policy that disallows inline script execution on WordPress front-end pages.
- Use a web application firewall to block requests containing <script> or event-handler patterns within shortcode attributes.
# Disable the plugin via WP-CLI until a fix is available
wp plugin deactivate st-category-wp
# Search database for shortcode instances that may contain injected payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[st-categories%' AND (post_content LIKE '%<script%' OR post_content LIKE '%javascript:%' OR post_content LIKE '%onerror=%');"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
