CVE-2025-11765: 
WordPress vulnerability analysis and mitigation

CVE-2025-11765 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stock Tools plugin for WordPress, affecting all versions up to and including 1.1. The flaw exists in the image_height and image_width shortcode attributes, which lack sufficient input sanitization and output escaping. It was disclosed on November 21, 2025, by Wordfence, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization of the image_height and image_width parameters passed to the plugin's shortcode handler. An authenticated attacker with at least contributor-level access can embed arbitrary JavaScript within these attributes; the unsanitized values are then rendered directly into page output, executing in the browsers of any user who visits the affected page. The vulnerable code path is visible in the plugin source at line 67 of stock-tools.php (WordPress Plugin Trac, Wordfence).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject malicious scripts into WordPress pages, which execute in the context of any visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement, or redirection of site visitors to malicious content. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact; however, the changed scope means the attack can affect users beyond the attacker's own session (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires authenticated access at the contributor level, which limits the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Stock Tools plugin (version ≤ 1.1) by inspecting page source for plugin-specific assets or using tools like WPScan.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page using the Stock Tools shortcode, injecting a JavaScript payload into the image_height or image_width attribute, e.g., [stock_tools image_height="1" onmouseover="alert(document.cookie)" image_width="1"] or a more targeted XSS payload.
4. Publish the page: Submit the post for publication (contributors may require editor approval, but editors/admins can publish directly).
5. Harvest victim data: When any site visitor loads the injected page, the malicious script executes in their browser, enabling session token theft, credential phishing, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing unusual values in shortcode parameters (e.g., image_height or image_width fields with script tags or event handler strings).
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or JavaScript event handlers within Stock Tools shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the Stock Tools shortcode, potentially indicating data exfiltration (e.g., cookie theft via document.location redirects).
• Application: WordPress audit logs (if enabled via plugins like WP Activity Log) recording post edits by contributor-level accounts that include shortcode content with non-numeric image_height or image_width values.

As of the disclosure date (November 21, 2025), no patched version of the Stock Tools plugin has been confirmed as available; all versions through 1.1 are affected (Wordfence). Site administrators should consider deactivating and removing the Stock Tools plugin until a patched release is published. As a compensating control, restrict contributor-level account creation and review existing contributor accounts for trustworthiness. A Web Application Firewall (WAF) with XSS filtering rules, such as Wordfence's own firewall, can help block exploitation attempts in the interim.

The vulnerability was discovered and reported by Wordfence, which published the advisory through its threat intelligence platform. No significant broader media coverage, researcher commentary, or notable social media discussion has been identified beyond the initial disclosure (Wordfence).