CVE-2025-11818

Vulnerability

Analysis

The WP Responsive Meet The Team plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.1 [1]. The flaw lies in the 'wprm_team' shortcode's handling of user-supplied attributes, which lack proper input sanitization and output escaping. This allows untrusted data to be stored and later rendered in pages without safe encoding.

Exploitation

An attacker must be authenticated with at least contributor-level access to exploit this vulnerability. By crafting a malicious shortcode attribute, the attacker can inject arbitrary JavaScript or HTML. When the shortcode is rendered on a page, the injected script executes in the context of any user who subsequently visits that page.

Impact

Successful exploitation leads to stored XSS, enabling the attacker to perform actions such as stealing session cookies, redirecting users, or defacing the site. Since the script executes in the victim's browser, it can be used to escalate privileges or compromise other users.

Mitigation

The plugin has been closed as of October 17, 2025, and is no longer available for download [1]. Users should remove the plugin immediately and look for an alternative. There is no patched version available.