CVE-2025-13031: 
WordPress vulnerability analysis and mitigation

CVE-2025-13031 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPeMatico RSS Feed Fetcher WordPress plugin affecting versions before 2.8.13. The flaw allows high-privilege users (Contributor-level and above) to inject and store malicious scripts via unsanitized plugin settings. It was publicly disclosed on November 18, 2025, and assigned a CVSS v3.1 base score of 5.9 (Medium) (WPScan, Red Hat).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) and stems from insufficient input sanitization and output escaping in the plugin's campaign settings (WPScan). Two distinct injection points exist: the "Post Template" custom post template textbox and the "Rewrite Options" textboxes (available when the 'Enable "Rewrite" feature' is enabled by an admin). A Contributor-level user can submit a campaign containing a malicious JavaScript payload (e.g., <script>alert(document.cookie)</script>), which is stored and later executed in the browser of any administrator who views the campaign. Exploitation requires the attacker to have at minimum Contributor access to the WordPress admin dashboard (WPScan).

Successful exploitation allows a Contributor-level attacker to execute arbitrary JavaScript in the context of an administrator's browser session, potentially leading to session cookie theft, credential harvesting, unauthorized administrative actions, or further site compromise. The scope is changed (S:C in CVSS terms), meaning the impact extends beyond the attacker's own privilege level to affect higher-privileged users. While confidentiality, integrity, and availability impacts are each rated Low individually, the chained risk of admin session hijacking could escalate to full site takeover (WPScan, Red Hat).

A proof-of-concept (PoC) is publicly available via WPScan, detailing two specific exploitation paths (WPScan). There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated Contributor account, limiting the attack surface compared to unauthenticated vulnerabilities.

1. Gain Contributor Access: Obtain or register a Contributor-level account on the target WordPress site running WPeMatico RSS Feed Fetcher < 2.8.13.
2. Create a New Campaign (Post Template XSS): Log in to WP Admin, navigate to the WPeMatico tab, and select "Add New Campaign". Enter a campaign title and add a valid RSS feed URL.
3. Inject XSS Payload: Scroll to "Post Template", enable "Use custom posts template", and paste a malicious payload such as <script>alert(document.cookie)</script> into the custom post template textbox.
4. Submit Campaign: Click "Submit for review". The XSS payload triggers immediately upon submission in the contributor's own session.
5. Trigger Admin Execution: When a Superadmin navigates to WPeMatico → All Campaigns and opens the submitted campaign, the stored payload executes in their browser, potentially exposing session cookies or enabling further actions.
6. Alternative – Rewrite Options XSS: If the admin has enabled the 'Enable "Rewrite" feature', a Contributor can instead inject the payload into the "Rewrite Options" textboxes during campaign creation, achieving the same stored XSS effect (WPScan).

• Logs: WordPress access logs showing POST requests to campaign creation or settings endpoints (/wp-admin/post.php or similar) from Contributor-level accounts containing encoded script tags or JavaScript event handlers.
• Database: Stored entries in the wp_posts or plugin-specific settings tables containing <script>, javascript:, onerror=, or similar XSS patterns in campaign template or rewrite option fields.
• Browser/Session: Unexpected outbound requests from administrator browsers to unknown external domains shortly after viewing campaign pages, potentially indicating cookie exfiltration.
• File System: New or modified files in the WordPress installation (e.g., rogue admin accounts, backdoors) that may result from a successful admin session hijack following XSS exploitation (WPScan).

Update the WPeMatico RSS Feed Fetcher plugin to version 2.8.13 or later, which includes proper sanitization and escaping of the affected settings fields (WPScan). As a temporary workaround, restrict Contributor-level user access to WPeMatico campaign creation features, or disable the plugin until patching is feasible. Site administrators should also review existing campaigns for suspicious content in the Post Template and Rewrite Options fields.

The vulnerability was discovered and reported by researcher Alex Tselevich (nos3curity) and verified by WPScan (WPScan). No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database listings.