CVE-2025-13623: 
WordPress vulnerability analysis and mitigation

CVE-2025-13623 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Twitscription plugin for WordPress, affecting all versions up to and including 0.1.1. The flaw exists due to insufficient input sanitization and output escaping of the admin.php PATH_INFO parameter, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on December 5, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code is located in twitscription.php at line 101, where the PATH_INFO value from admin.php requests is reflected into the page output without proper sanitization or escaping. An unauthenticated attacker can craft a malicious URL containing a JavaScript payload in the PATH_INFO segment; if a logged-in user (e.g., an administrator) clicks the link, the script executes in their browser context. The attack vector is network-based, requires no privileges, but does require user interaction (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the context of the WordPress site, potentially leading to session cookie theft, credential harvesting, or unauthorized administrative actions. Because the scope is changed (S:C in CVSS), the injected script can affect resources beyond the vulnerable component itself. Confidentiality and integrity are both rated as low impact, with no direct availability impact; however, chained with social engineering, this could facilitate account takeover of privileged WordPress users (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13623 as of the available data. The EPSS score is approximately 0.087%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Twitscription plugin (version ≤ 0.1.1) using tools like WPScan or by checking publicly accessible plugin directories.
2. Craft malicious URL: Construct a URL targeting the vulnerable admin.php endpoint with a JavaScript payload embedded in the PATH_INFO segment, e.g., https://target-site.com/wp-admin/admin.php/<script>alert(document.cookie)</script>.
3. Social engineering: Deliver the crafted URL to a privileged WordPress user (e.g., administrator) via phishing email, forum post, or other communication channel.
4. Payload execution: When the victim clicks the link and loads the page while authenticated, the unsanitized PATH_INFO is reflected into the HTML response, causing the injected script to execute in their browser.
5. Objective achieved: The attacker can steal session cookies, capture credentials, perform actions on behalf of the victim, or redirect the user to a malicious site (Wordfence, WordPress Plugin Trac).

• Network: HTTP requests to /wp-admin/admin.php/ with unusual PATH_INFO values containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=).
• Logs: WordPress or web server access logs showing GET/POST requests to admin.php with PATH_INFO segments containing HTML or JavaScript characters; look for patterns like <script>, javascript:, or encoded equivalents.
• Browser/Session: Unexpected session token exfiltration attempts or outbound requests from the victim's browser to attacker-controlled domains following interaction with a suspicious link.

The Twitscription plugin (version 0.1.1 and below) does not appear to have a patched release available at the time of disclosure; users should check the WordPress plugin repository for any updated versions. As an immediate workaround, administrators should deactivate and remove the Twitscription plugin until a patched version is released. Additionally, implementing a Web Application Firewall (WAF) rule to block requests with script-like content in PATH_INFO can reduce exposure (Wordfence, WordPress Plugin Page).