CVE-2025-13355: 
WordPress vulnerability analysis and mitigation

CVE-2025-13355 is a Reflected Cross-Site Scripting (XSS) vulnerability in the URL Shortify WordPress plugin affecting all versions before 1.11.4. The flaw allows unauthenticated attackers to craft malicious URLs that, when opened by a logged-in administrator, execute arbitrary JavaScript in the admin's browser context. The vulnerability was discovered and reported by researcher Gregory Allegoet, publicly published on November 24, 2025, and assigned a CVE on December 15, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (WPScan, Red Hat CVE).

The root cause is improper neutralization of user-supplied input before it is reflected back in the HTML page output (CWE-79). Specifically, the plugin fails to sanitize or escape the form_data[cpt_id] parameter in the admin page handler (/wp-admin/admin.php?page=us_links), allowing an attacker to inject arbitrary HTML/JavaScript. The attack requires no authentication on the attacker's part but does require social engineering to get a privileged user (e.g., an administrator) to click a crafted URL. A public proof-of-concept URL is available via WPScan (WPScan).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser session of a high-privilege WordPress user such as an administrator. This can lead to session token theft, unauthorized administrative actions (e.g., creating rogue admin accounts, installing malicious plugins), site defacement, or redirection of site visitors to malicious content. Because the attack targets admin-level users, the potential for full site compromise is significant (WPScan, Red Hat CVE).

A public proof-of-concept is available via WPScan, lowering the barrier for exploitation. The vulnerability requires user interaction (an admin must click the crafted link), but no authentication is needed from the attacker's side. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low but non-zero probability of exploitation in the near term. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the URL Shortify plugin (versions before 1.11.4) via passive scanning, Wappalyzer, or WordPress plugin enumeration tools.
2. Craft malicious URL: Construct a URL targeting the vulnerable admin endpoint with an XSS payload injected into the form_data[cpt_id] parameter, e.g.:

   https://example.com/wp-admin/admin.php?page=us_links&action=new&form_data[cpt_id]=a">alert(/XSS/)</script>&submitted=submitted&submit=Save+Link

3. Social engineering: Deliver the crafted URL to a logged-in WordPress administrator via phishing email, forum post, or other communication channel.
4. Payload execution: When the admin clicks the link and loads the page, the unsanitized parameter is reflected in the HTML output, causing the injected script to execute in the admin's browser session.
5. Post-exploitation: Use the XSS to steal session cookies, perform CSRF actions (e.g., create a new admin account), or install a malicious plugin to achieve persistent access (WPScan).

• Network: HTTP GET requests to /wp-admin/admin.php?page=us_links&action=new containing URL-encoded script tags or HTML injection characters (e.g., %3Cscript%3E, %22%3E, alert() in the form_data[cpt_id] parameter.
• Logs: WordPress or web server access logs showing requests to the above endpoint with anomalous or encoded payloads in query string parameters; unusual admin-panel activity following such requests.
• File System: Unexpected new WordPress admin accounts, newly installed plugins, or modified theme files following a suspected XSS exploitation event.
• Process/Behavior: Unusual outbound connections from the web server following admin interaction with a suspicious URL; admin session cookies appearing in unexpected locations or being reused from unfamiliar IP addresses.

Update the URL Shortify WordPress plugin to version 1.11.4 or later, which includes proper sanitization and escaping of the affected parameter. No configuration-based workaround is available; upgrading is the only effective remediation. As a general precaution, administrators should avoid clicking unsolicited or unexpected links to their WordPress admin panel, and consider deploying a Web Application Firewall (WAF) to detect and block reflected XSS attempts (WPScan).

The vulnerability was reported and verified by independent researcher Gregory Allegoet and submitted through WPScan's responsible disclosure process. It was included in Wordfence's weekly WordPress vulnerability report for the period of November 24–30, 2025, indicating routine community tracking of the issue. No significant vendor statements or major media coverage beyond standard vulnerability aggregation have been observed (Wordfence Blog).