Stored Cross-Site Scripting in Simple Business Data Plugin for WordPress

CVE-2025-11870

What is CVE-2025-11870?

The Simple Business Data plugin for WordPress presents a vulnerability that allows stored Cross-Site Scripting (XSS) through the 'simple_business_data' shortcode attributes. This issue arises because the plugin fails to sanitize user inputs appropriately and does not escape outputs when embedding the type attribute into the class attribute within rendered HTML. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages, leading to potential attacks each time a user accesses the compromised page.

References