Stored Cross-Site Scripting Vulnerability in Shortcodes Bootstrap Plugin for WordPress

CVE-2025-11764

What is CVE-2025-11764?

The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'type' parameter in the [notification] shortcode found in all versions up to and including 1.1. This vulnerability arises from the inadequate sanitization of user inputs and a lack of proper output escaping, allowing authenticated attackers with contributor-level access or higher to insert arbitrary web scripts. These scripts may execute whenever a user accesses infected pages, posing a significant threat to site integrity and user data security.

References