CVE-2025-11822 is a stored cross-site scripting vulnerability in the WP Bootstrap Tabs plugin for WordPress, affecting all versions up to and including 1.0.4. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of attributes passed to the 'bootstrap_tab' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of session tokens, defacement, or other client-side attacks affecting confidentiality and integrity. There is no indication of exploitation in the wild. The vulnerability does not affect availability.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access to trusted individuals and consider disabling or removing the WP Bootstrap Tabs plugin until a fix is released. Monitor the vendor's advisory channels for updates regarding remediation. Implementing additional input sanitization or output escaping at the application level may help mitigate risk but is not a substitute for an official fix.