CVE-2025-11186

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11186", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-30T08:52:10.498Z", "datePublished": "2025-11-22T05:07:42.720Z", "dateUpdated": "2026-04-08T16:37:51.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:51.667Z"}, "affected": [{"vendor": "humanityco", "product": "Cookie Notice & Compliance for GDPR / CCPA", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.5.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19700658-1bef-4e85-a995-d86fff508cdf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1060"}, {"url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1181"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-09-29T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-17T17:28:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-21T16:28:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-24T19:28:47.629099Z", "id": "CVE-2025-11186", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:28:57.051Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11186", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-24T19:28:47.629099Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-24T19:28:52.114Z"}}], "cna": {"title": "Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "humanityco", "product": "Cookie Notice & Compliance for GDPR / CCPA", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.5.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-17T17:28:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-21T16:28:14.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19700658-1bef-4e85-a995-d86fff508cdf?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1060"}, {"url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1181"}], "descriptions": [{"lang": "en", "value": "The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-22T05:07:42.720Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11186", "state": "PUBLISHED", "dateUpdated": "2025-11-24T19:28:57.051Z", "dateReserved": "2025-09-30T08:52:10.498Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-22T05:07:42.720Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Cookie Notice & Compliance for GDPR / CCPA", "vendor": "humanityco", "versions": [{"lessThanOrEqual": "2.5.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Cookie Notice & Compliance for GDPR / CCPA para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'cookies_accepted' del plugin en todas las versiones hasta la 2.5.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-11186", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11186", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-24T19:28:47.629099Z", "version": "2.0.3"}}]}, "published": "2025-11-22T05:15:59.610", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1060"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cookie-notice/tags/2.5.7/cookie-notice.php#L1181"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/19700658-1bef-4e85-a995-d86fff508cdf?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:03:18.480531+00:00", "value": {"mitigation_remediation": ["Upgrade the Cookie Notice & Compliance plugin to the latest version released after 2.5.8, which removes the unescaped attributes from the shortcode.", "If an upgrade cannot be performed immediately, delete or disable all instances of the cookies_accepted shortcode from posts, pages, and widgets to prevent the stored XSS vector.", "Restrict contributor and other non-admin roles from editing content that includes shortcodes, or apply a site\u2011wide filter to escape any remaining shortcode attributes before rendering."], "summary": {"action": "Apply patch", "impact": "Stored Cross\u2011Site Scripting that allows an authenticated contributor or higher to inject arbitrary scripts into pages"}, "threat_synthesis": {"affected_systems": "All WordPress sites using the humanityco Cookie Notice & Compliance for GDPR / CCPA plugin up to and including version 2.5.8 are affected. The issue exists within the plugin\u2019s cookies_accepted shortcode functionality, and any site that embeds this shortcode in posts, pages or widgets can be exploited. The vulnerability is only present in older releases; newer releases beyond 2.5.8 have been patched.", "description_and_impact": "The vulnerability arises from insufficient sanitization of user supplied attributes in the cookies_accepted shortcode of the Cookie Notice & Compliance for GDPR / CCPA plugin. This permits authenticated WordPress users with contributor-level or higher access to store arbitrary JavaScript that is rendered when any visitor views a page containing the shortcode. The stored payload can be used to hijack sessions, steal credentials, or deface the site, compromising both confidentiality and integrity of user data.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of widespread exploitation remains low at present. Because the attack requires authenticated contributor privileges, a site\u2019s internal user management configuration influences risk. Sites that grant many contributors write\u2011access are more vulnerable. The vulnerability is not listed in the CISA KEV catalog, so there are no confirmed widespread exploitation cases yet."}}}}, "created": "2025-11-24T09:08:17.112226+00:00", "updated": "2026-04-22T21:15:27.675514+00:00", "vendors": ["hu-manity", "hu-manity$PRODUCT$cookie_notice_&_compliance_for_gdpr_/_ccpa", "wordpress", "wordpress$PRODUCT$wordpress"]}