CVE-2025-11769 is a stored cross-site scripting vulnerability in the WordPress Content Flipper plugin (versions up to 0.1). The flaw exists because the plugin does not properly sanitize or escape the 'bgcolor' shortcode attribute in 'flipper_front', allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or user session compromise. The vulnerability does not affect availability and requires authenticated access, limiting its impact to environments where such access is granted.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access to trusted users only and consider disabling or removing the WordPress Content Flipper plugin until a fix is released. Avoid using the 'bgcolor' attribute in the 'flipper_front' shortcode if possible to reduce risk.