Stored Cross-Site Scripting in WP Bootstrap Tabs Plugin for WordPress

CVE-2025-11822

What is CVE-2025-11822?

The WP Bootstrap Tabs plugin for WordPress contains a vulnerability that allows authenticated attackers, with contributor-level access and above, to exploit stored cross-site scripting. This risk arises from inadequate input sanitization and output escaping of user-supplied attributes within the 'bootstrap_tab' shortcode, leading to the potential injection of arbitrary web scripts. Such injected scripts will execute whenever a user accesses affected pages, thereby compromising the security of the website and its visitors.

References