CVE-2025-11808 is a stored cross-site scripting vulnerability in the Shortcode for Google Street View WordPress plugin by antiochinteractive. The issue arises from insufficient input sanitization and output escaping on the 'id' attribute within the 'streetview' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 0.5.7. No known exploits are reported in the wild, and no patch or remediation is currently available.

An attacker with contributor-level or higher access can inject malicious JavaScript code into pages using the vulnerable shortcode. This code executes in the browsers of users who visit the infected pages, potentially leading to theft of cookies, session tokens, or other sensitive information. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Shortcode for Google Street View plugin if possible. Monitor plugin updates from antiochinteractive for a security patch addressing this vulnerability.