CVE-2025-11763

The Display Pages Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column_count' parameter in the [display-pages] shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/display-pages-shortcode/trunk/display-pages-shortcode.php#L513
• https://plugins.trac.wordpress.org/browser/display-pages-shortcode/trunk/display-pages-shortcode.php#L517
• https://www.wordfence.com/threat-intel/vulnerabilities/id/df4ada5f-6008-40b9-ad83-c6af82e64e9f?source=cve

Published

Nov 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11758The All in One Time Clock Lite plugin for WordPress is vulne…6.5
• CVE-2025-11759The Backup, Restore and Migrate your sites with XCloner plug…4.3
• CVE-2025-1176A vulnerability was found in GNU Binutils 2.43 and classifie…5
• CVE-2025-11760The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, …5.3
• CVE-2025-11761A potential security vulnerability has been identified in th…7.8
• CVE-2025-11762The HubSpot All-In-One Marketing - Forms, Popups, Live Chat …4.3
• CVE-2025-11764The Shortcodes Bootstrap plugin for WordPress is vulnerable …6.4
• CVE-2025-11765The Stock Tools plugin for WordPress is vulnerable to Stored…6.4
• CVE-2025-11767The Tips Shortcode plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-11768The Islamic Phrases plugin for WordPress is vulnerable to St…6.4
• CVE-2025-11769The WordPress Content Flipper plugin for WordPress is vulner…6.4
• CVE-2025-1177A vulnerability was found in dayrui XunRuiCMS 4.6.3. It has …9.8