{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11828", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-15T18:51:23.266Z", "datePublished": "2025-11-11T03:30:44.964Z", "dateUpdated": "2026-04-08T17:06:37.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:37.008Z"}, "affected": [{"vendor": "pubudu-malalasekara", "product": "Post Blocks & Tools", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa2e98b-5054-46fd-b22e-eac59b581a3c?source=cve"}, {"url": "https://wordpress.org/plugins/bnm-blocks"}, {"url": "https://plugins.trac.wordpress.org/browser/bnm-blocks/tags/1.2.3/src/blocks/posts/featured-posts-1/view.php#L34"}, {"url": "https://plugins.trac.wordpress.org/changeset/3392064/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-11-10T15:05:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-14T15:21:05.909506Z", "id": "CVE-2025-11828", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:30:44.205Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11828", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-14T15:21:05.909506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-14T15:21:06.544Z"}}], "cna": {"title": "Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "pubudu-malalasekara", "product": "Magazine Companion", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:05:52.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa2e98b-5054-46fd-b22e-eac59b581a3c?source=cve"}, {"url": "https://wordpress.org/plugins/bnm-blocks"}, {"url": "https://plugins.trac.wordpress.org/browser/bnm-blocks/tags/1.2.3/src/blocks/posts/featured-posts-1/view.php#L34"}], "descriptions": [{"lang": "en", "value": "The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-11T03:30:44.964Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11828", "state": "PUBLISHED", "dateUpdated": "2025-11-14T15:30:44.205Z", "dateReserved": "2025-10-15T18:51:23.266Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:44.964Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Magazine Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headerHtmlTag' attribute in the bnm-blocks/featured-posts-1 block in all versions up to, and including, 1.2.3. This is due to insufficient input sanitization and output escaping when using user-supplied values as HTML tag names. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11828", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-11T04:15:42.603", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/bnm-blocks/tags/1.2.3/src/blocks/posts/featured-posts-1/view.php#L34"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3392064/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/bnm-blocks"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fa2e98b-5054-46fd-b22e-eac59b581a3c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:52:12.599547+00:00", "value": {"mitigation_remediation": ["Upgrade the Post Blocks & Tools plugin to the latest available version (any release above 1.2.3).", "If an update is unavailable, remove or disable the featured\u2011posts block that uses the headerHtmlTag attribute to prevent further exploitation.", "Verify that all contributors and editors are using strong authentication and consider limiting the Contributor role to read\u2011only access if the block is not required."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting that allows authenticated contributors to inject and execute arbitrary scripts on pages accessed by other users"}, "threat_synthesis": {"affected_systems": "All installations of the Post Blocks & Tools plugin version 1.2.3 or earlier for WordPress are susceptible. The flaw exists in a single block module used by the plugin and does not affect WordPress core or other plugins directly.", "description_and_impact": "The Post Blocks & Tools WordPress plugin contains a stored XSS flaw where the headerHtmlTag attribute in the featured\u2011posts block accepts unsanitised user input and outputs it directly as an HTML tag name. An attacker who can edit content as a contributor, editor or administrator can craft an arbitrary JavaScript payload in this field. When the crafted block is displayed, the payload runs in the context of any visitor\u2019s browser, which can lead to credential theft, defacement or session hijacking.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate risk, and the EPSS score of less than 1% shows a low probability of exploitation in the current landscape. Because the attack requires authenticated contributor\u2011level access, it is generally limited to sites with an attacker who has compromised an existing user account. The flaw is not listed in the CISA KEV catalog, but the ability to subvert site security remains significant for targeted attacks."}}}}, "created": "2025-11-12T12:48:05.776322+00:00", "updated": "2026-04-22T13:00:09.729930+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}