Stored Cross-Site Scripting Flaw in BrightTALK WordPress Shortcode Plugin

CVE-2025-11770

What is CVE-2025-11770?

The BrightTALK WordPress Shortcode plugin suffers from a severe vulnerability that allows authenticated attackers with contributor-level access and above to exploit the 'format' attribute within the brighttalk-time shortcode. Due to inadequate input sanitization and output escaping mechanisms, attackers can inject arbitrary web scripts into pages. These scripts execute when users visit affected pages, potentially compromising user data and site integrity.

References