CVE-2025-11857

The XX2WP Integration Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mxp_fb2wp_display_embed' shortcode in all versions up to, and including, 1.9.9. This is due to the plugin not properly sanitizing user input and output of the 'post_id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/fb2wp-integration-tools/tags/1.9.9/index.php#L302
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379625%40fb2wp-integration-tools&new=3379625%40fb2wp-integration-tools&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb28e2-a7a1-4e33-93e5-872d6f2e00ec?source=cve

Published

Oct 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11851A vulnerability has been found in Apeman ID71 EN75.8.53.20. …3.5
• CVE-2025-11852A vulnerability was found in Apeman ID71 218.53.203.117. The…5.5
• CVE-2025-11853A vulnerability was determined in Sismics Teedy up to 1.11. …8.1
• CVE-2025-11854Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2025-11855The age-restriction WordPress plugin through 3.0.2 does not …7.5
• CVE-2025-11856The Eventbee Ticketing Widget plugin for WordPress is vulner…6.4
• CVE-2025-11859The Paypal Donation Shortcode plugin for WordPress is vulner…6.4
• CVE-2025-1186A vulnerability was found in dayrui XunRuiCMS up to 4.6.4. I…9.8
• CVE-2025-11860The Twitter Feed plugin for WordPress is vulnerable to Store…6.4
• CVE-2025-11862A security issue was discovered within Verve Asset Manager a…8.4
• CVE-2025-11863The My Geo Posts Free plugin for WordPress is vulnerable to …6.4
• CVE-2025-11864A vulnerability was identified in NucleoidAI Nucleoid up to …7.3