Stored Cross-Site Scripting Vulnerability in Shortcodes Bootstrap Plugin for WordPress

CVE-2025-11764

What is CVE-2025-11764?

The Shortcodes Bootstrap plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'type' parameter in the [notification] shortcode found in all versions up to and including 1.1. This vulnerability arises from the inadequate sanitization of user inputs and a lack of proper output escaping, allowing authenticated attackers with contributor-level access or higher to insert arbitrary web scripts. These scripts may execute whenever a user accesses infected pages, posing a significant threat to site integrity and user data security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References