CVE-2025-13625: 
WordPress vulnerability analysis and mitigation

CVE-2025-13625 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WP-SOS-Donate Donation Sidebar Plugin for WordPress. It affects all versions up to and including 0.9.2, developed by switch2mac. The flaw arises from insufficient input sanitization and output escaping of the $_SERVER['PHP_SELF'] parameter, allowing unauthenticated attackers to inject arbitrary web scripts. It was published on December 5, 2025, and carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is the direct use of the PHP superglobal $_SERVER['PHP_SELF'] in the plugin's options page (wp-sos-donate_options.php, line 45) without proper sanitization or escaping before output. An attacker can craft a malicious URL containing a JavaScript payload in the path component, which PHP reflects back into the page via PHP_SELF. Exploitation requires tricking an authenticated or unauthenticated user into clicking the crafted link, at which point the injected script executes in the victim's browser within the context of the WordPress site (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser session within the WordPress site's origin, crossing trust boundaries (scope changed). This can lead to session cookie theft, credential harvesting, defacement of page content visible to the victim, or redirection to malicious sites. Confidentiality and integrity impacts are rated low, and there is no direct availability impact; however, chained with social engineering, the vulnerability could facilitate account takeover of site administrators (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13625. The EPSS score is approximately 0.087%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must click a crafted link — which reduces the practical risk compared to fully unauthenticated, interaction-free vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the WP-SOS-Donate plugin (version ≤ 0.9.2) by searching for plugin-specific file paths (e.g., /wp-content/plugins/wp-sos-donate/) using tools like Shodan, Google dorks, or WPScan.
2. Identify vulnerable endpoint: Locate the plugin's options/admin page that renders $_SERVER['PHP_SELF'] unsanitized — specifically wp-sos-donate_options.php.
3. Craft malicious URL: Construct a URL where the path component contains a JavaScript payload, exploiting how PHP populates PHP_SELF from the request URI. Example: https://target.com/wp-admin/options-general.php/wp-sos-donate_options.php/<script>alert(document.cookie)</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, forum post, or other social engineering channel.
5. Script execution: When the victim clicks the link and the page loads, the injected script executes in their browser within the WordPress site's origin, potentially exfiltrating session cookies or performing actions on behalf of the victim (Wordfence, WordPress Plugin Trac).

• Network: HTTP requests to WordPress admin or plugin pages with unusual path segments containing encoded JavaScript (e.g., %3Cscript%3E, <script>, javascript:) in the URL path component following wp-sos-donate_options.php.
• Logs: Web server access logs showing GET requests to plugin option pages with script tags or encoded XSS payloads in the URI path; referrer headers pointing to external phishing domains.
• Browser/Client-Side: Unexpected JavaScript execution or redirects originating from the WordPress site's domain after visiting a link from an external source.

As of the disclosure date (December 5, 2025), no patched version of the WP-SOS-Donate plugin beyond 0.9.2 has been released. The recommended immediate action is to deactivate and remove the plugin from all WordPress installations until a patched version is available. Site administrators should also implement a Web Application Firewall (WAF) rule to block requests containing script tags or encoded XSS payloads in URL paths as a temporary mitigation (Wordfence, WordPress Plugin Page).

The vulnerability was discovered and disclosed by Wordfence, which published the advisory on December 5, 2025. No significant broader media coverage, researcher commentary, or notable social media discussion has been identified beyond standard vulnerability aggregator listings (Wordfence).