CVE-2025-13071: 
WordPress vulnerability analysis and mitigation

CVE-2025-13071 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Custom Admin Menu WordPress plugin through version 1.0.0. The plugin fails to sanitize and escape a user-supplied parameter before reflecting it back in the page output, enabling attackers to inject malicious scripts. It was publicly disclosed on November 18, 2025, and assigned a CVSS v3.1 base score of 7.1 (High) (WPScan, Red Hat CVE).

The root cause is improper neutralization of input during web page generation (CWE-79), where the msg parameter passed to the plugin's admin settings page is reflected in the HTML response without sanitization or escaping. An attacker can craft a malicious URL targeting the /wp-admin/admin.php?page=adminmenu-settings&msg= endpoint and inject arbitrary JavaScript (e.g., <svg/onload=alert(document.domain)>). Exploitation requires no authentication but does require user interaction — specifically, a high-privilege user such as an administrator must be tricked into clicking the crafted link (WPScan).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a logged-in administrator's browser session, potentially leading to session token theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and full site compromise. Because the attack targets high-privilege users, the blast radius extends to the entire WordPress installation and any data accessible to the administrator (WPScan, Red Hat CVE).

A public proof-of-concept URL is available via WPScan, making exploitation straightforward for any attacker who can deliver the crafted link to an administrator. The EPSS score is 0.029% (very low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation or inclusion in the CISA KEV catalog at this time. No threat actor attribution has been reported (WPScan, Feedly).

1. Reconnaissance: Identify WordPress sites running the Custom Admin Menu plugin (version ≤ 1.0.0) using tools like WPScan, Shodan, or manual inspection of plugin directories.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an injected XSS payload, e.g., https://target.com/wp-admin/admin.php?page=adminmenu-settings&msg=<svg/onload=alert(document.domain)>.
3. Deliver the payload: Send the crafted URL to a high-privilege WordPress user (e.g., administrator) via phishing email, social engineering, or embedding in a comment/forum post.
4. Trigger execution: When the administrator clicks the link while authenticated, the browser executes the injected JavaScript in the context of the admin session.
5. Achieve objective: Use the executed script to steal session cookies, perform unauthorized admin actions (e.g., create a backdoor admin account, install a malicious plugin), or redirect the victim to an attacker-controlled page (WPScan).

• Network: HTTP GET requests to /wp-admin/admin.php?page=adminmenu-settings containing URL-encoded HTML/JavaScript tags (e.g., %3Csvg, %3Cscript, onload=, alert() in the msg parameter.
• Logs: WordPress or web server access logs showing requests to the above endpoint with suspicious msg parameter values from external or unexpected IP addresses.
• Logs: Evidence of administrator sessions performing unusual actions (e.g., new admin user creation, plugin installation) shortly after accessing a suspicious URL.
• File System: Unexpected new WordPress admin accounts or newly installed/modified plugins following a potential exploitation event.

As of the disclosure date (November 18, 2025), there is no known fix available for the Custom Admin Menu plugin — WPScan lists it as having "no known fix" (WPScan). Site administrators should immediately deactivate and remove the Custom Admin Menu plugin until a patched version is released. As a general defense-in-depth measure, implement a Web Application Firewall (WAF) to filter reflected XSS payloads, and train administrators to be cautious of unsolicited links to the WordPress admin panel.

The vulnerability was discovered and reported by researcher Yousof Nahya, who submitted it to WPScan (WPScan). It was included in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of November 17–23, 2025. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking platforms.