CVE-2025-11818 is a stored cross-site scripting vulnerability in the WP Responsive Meet The Team plugin for WordPress, affecting all versions up to 1.0.1. The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the 'wprm_team' shortcode. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into pages via the 'wprm_team' shortcode. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. There are no known exploits in the wild at this time.

No official patch or remediation has been documented yet for this vulnerability. Users should monitor the vendor's advisory channels for updates and consider restricting contributor-level access until a fix is available. Applying strict input validation or disabling the vulnerable shortcode may reduce risk temporarily. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.