CVE-2025-13624: 
WordPress vulnerability analysis and mitigation

CVE-2025-13624 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Overstock Affiliate Links plugin for WordPress, affecting all versions up to and including 1.1. The flaw exists in the $_SERVER['PHP_SELF'] parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on December 20, 2025, and assigned a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of the unsanitized $_SERVER['PHP_SELF'] superglobal variable directly in output within sandbox_page.php (line 18). In PHP, $_SERVER['PHP_SELF'] reflects the URL path of the current script and can be manipulated by appending malicious content to the URL, which is then echoed into the page without escaping. Exploitation requires no authentication and no special privileges, but does require user interaction — a victim must click a crafted link (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content as seen by the victim. The scope is changed (cross-origin impact possible), with low confidentiality and integrity impact and no availability impact (Wordfence, Red Hat CVE).

No patch is available for affected versions through 1.1, and no evidence of active in-the-wild exploitation or inclusion in CISA's Known Exploited Vulnerabilities catalog has been reported. The EPSS score is approximately 0.087%, indicating a low probability of exploitation in the near term. No exploit kits or threat actor attribution have been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites using the Overstock Affiliate Links plugin (version ≤ 1.1) via search engines, WPScan, or by checking /wp-content/plugins/overstock-affiliate-links/ for plugin presence.
2. Identify vulnerable endpoint: Locate the sandbox_page.php file served by the plugin, which unsafely outputs $_SERVER['PHP_SELF'].
3. Craft malicious URL: Construct a URL targeting the vulnerable page with a malicious script appended to the path, e.g., https://victim-site.com/wp-content/plugins/overstock-affiliate-links/sandbox_page.php/<script>alert(document.cookie)</script>.
4. Deliver payload: Send the crafted URL to a target user via phishing email, social media, or other social engineering channels, tricking them into clicking the link.
5. Script execution: When the victim loads the URL, the injected script executes in their browser, enabling cookie theft, session hijacking, or further malicious actions (Wordfence, WordPress Trac).

• Network: HTTP requests to /wp-content/plugins/overstock-affiliate-links/sandbox_page.php with URL-encoded script tags or JavaScript payloads in the path component.
• Logs: Web server access logs showing requests to sandbox_page.php with unusual characters such as <script>, %3Cscript%3E, javascript:, or onerror= in the request URI.
• File System: No file-level artifacts expected for reflected XSS; however, monitor for any unexpected modifications to plugin files that could indicate secondary compromise.
• Process/Behavior: Unusual outbound requests from victim browsers to attacker-controlled domains following interaction with crafted links, potentially visible in browser history or proxy logs.

As of the disclosure date, no patched version of the Overstock Affiliate Links plugin is available beyond version 1.1. The recommended immediate action is to deactivate and remove the plugin from all WordPress installations. Site administrators should also implement a Web Application Firewall (WAF) rule to block requests containing script injection patterns in the URL path as a temporary measure. Monitoring the WordPress plugin repository for an updated release is advised (Wordfence, WordPress Plugin).

The vulnerability was reported and disclosed by Wordfence, which serves as the primary authoritative source. It was also picked up by ENISA's European Vulnerability Database (EUVD-2025-204626) and referenced by INCIBE-CERT. Community coverage has been limited, consistent with the plugin's low install base and medium severity rating (Wordfence, ENISA EUVD).