CVE-2025-11827

Vulnerability

Overview The Oboxmedia Ads plugin for WordPress, in all versions up to and including 1.9.8, is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the 'oboxads-ad-widget' shortcode, specifically in the 'before_widget' and 'after_widget' parameters, due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web scripts that are stored and executed when pages are accessed.

Exploitation

Conditions To exploit this vulnerability, an attacker must have at least contributor-level access to the WordPress site. The attacker can then craft a shortcode with malicious JavaScript in the parameters, which will be stored and executed whenever a user views the compromised page.

Impact and

Mitigation Successful exploitation leads to arbitrary script execution in the context of the victim's browser, potentially enabling data theft, session hijacking, or defacement. As of October 17, 2025, the plugin has been closed on the WordPress plugin directory due to this security issue [1]. No patched version is available; users should remove or replace the plugin to mitigate the risk.