CVE-2025-11802 is a stored cross-site scripting vulnerability in the Bulma Shortcodes WordPress plugin by bartboy011. The issue exists in the handling of the 'type' shortcode attribute within the bulma-notification shortcode, allowing authenticated contributors or higher to inject arbitrary scripts. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). It affects all versions up to and including 1.0. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges (contributor or higher).

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the context of users viewing the infected pages, potentially leading to session hijacking, privilege escalation, or other client-side impacts. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Bulma Shortcodes plugin if possible to prevent exploitation.