CVE-2025-11830 is a stored cross-site scripting vulnerability in the WP Restaurant Listings plugin for WordPress, affecting all versions up to 1.0.2. The issue occurs due to improper neutralization of input in the 'align' parameter of the restaurant_summary shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium impact with network attack vector, low attack complexity, and privileges required.

An authenticated attacker with contributor-level access or above can inject persistent malicious scripts via the 'align' parameter, which execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed in the context of the victim user. Availability is not impacted. The vulnerability requires authentication and user interaction (viewing the injected page). There are no reports of active exploitation.

No official patch or remediation has been documented for this vulnerability as of the published date. Users should monitor the vendor's advisory channels for updates and apply any future patches promptly. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP Restaurant Listings plugin if feasible to reduce exposure.