Stored Cross-Site Scripting in WP Bootstrap Tabs Plugin for WordPress

CVE-2025-11822

What is CVE-2025-11822?

The WP Bootstrap Tabs plugin for WordPress contains a vulnerability that allows authenticated attackers, with contributor-level access and above, to exploit stored cross-site scripting. This risk arises from inadequate input sanitization and output escaping of user-supplied attributes within the 'bootstrap_tab' shortcode, leading to the potential injection of arbitrary web scripts. Such injected scripts will execute whenever a user accesses affected pages, thereby compromising the security of the website and its visitors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References