CVE-2025-13308: 
WordPress vulnerability analysis and mitigation

CVE-2025-13308 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Application Passwords plugin for WordPress, affecting all versions up to and including 0.1.3. The flaw exists in the reject_url parameter, which fails to properly sanitize user-supplied URLs, allowing javascript: URI schemes to be injected. It was published on December 6, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from insufficient input sanitization and output escaping on the reject_url parameter in the plugin's application authorization flow. An attacker can craft a malicious URL embedding a javascript: URI scheme in the reject_url parameter; when a victim clicks the "No, I do not approve of this connection" button, the injected script executes in their browser context. Exploitation requires social engineering to trick the victim into clicking a crafted link, and the attacker needs at minimum a low-privileged account to initiate the authorization request. Vulnerable code paths are visible in the plugin source at auth-app.js (line 61) and class.application-passwords.php (lines 418 and 432) (Wordfence, ENISA EUVD).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and limited integrity and confidentiality compromise. Availability is not directly impacted, but a compromised admin session could enable further site takeover (Wordfence, Red Hat Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13308 as of the available data. The EPSS score is approximately 0.087%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to direct a victim to click a crafted link, which limits its practical attack surface (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Application Passwords plugin version 0.1.3 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Craft malicious URL: Construct a URL targeting the plugin's application authorization endpoint, injecting a javascript: URI scheme into the reject_url parameter (e.g., ?reject_url=javascript:alert(document.cookie)).
3. Social engineering: Deliver the crafted URL to a target victim (e.g., a WordPress administrator) via phishing email, forum post, or other communication channel, enticing them to click the link.
4. Trigger execution: When the victim visits the crafted URL and clicks the "No, I do not approve of this connection" button, the injected JavaScript executes in their browser session.
5. Achieve objective: Harvest session cookies, perform actions as the victim, or redirect to a malicious site to further compromise the account (Wordfence).

• Network: HTTP requests to the WordPress application authorization endpoint containing reject_url parameters with javascript: URI schemes or URL-encoded equivalents (e.g., javascript%3A).
• Logs: WordPress or web server access logs showing GET/POST requests to the application passwords authorization page with suspicious reject_url values; referrer headers pointing to external or unknown domains.
• Browser/Client: Unexpected JavaScript execution or redirects occurring when users interact with the Application Passwords authorization page.

Users should update the Application Passwords plugin to version 0.1.4 or later, which addresses the insufficient sanitization of the reject_url parameter. If an immediate update is not possible, consider disabling the plugin until patching can be performed. Site administrators should also review web application firewall (WAF) rules to block requests containing javascript: URI schemes in URL parameters (Wordfence, ENISA EUVD).

The vulnerability was reported and disclosed by Wordfence, which maintains the authoritative advisory. Red Hat also tracked the CVE in their security database. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified for this medium-severity plugin vulnerability (Wordfence, Red Hat Advisory).