CVE-2025-13676: 
WordPress vulnerability analysis and mitigation

CVE-2025-13676 is a Reflected Cross-Site Scripting (XSS) vulnerability in the JustClick registration plugin for WordPress, affecting all versions up to and including 0.1. The flaw stems from insufficient input sanitization and output escaping on the PHP_SELF server variable, allowing unauthenticated attackers to inject arbitrary web scripts. It was disclosed on January 24, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists at line 154 of justclick.php, where the PHP_SELF server variable is reflected into the page output without proper sanitization or escaping. An unauthenticated attacker can craft a malicious URL containing an injected script payload in the path component, which gets reflected into the rendered HTML when a victim visits or is tricked into clicking the link. The vulnerable code is publicly visible in the WordPress plugin repository (WordPress Plugin Repo, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of page content as seen by the victim. The scope is changed (S:C in CVSS), meaning the injected script can affect resources beyond the vulnerable component itself, though confidentiality and integrity impacts are rated low and availability is unaffected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13676. The EPSS score is approximately 0.089%, indicating a low probability of exploitation in the near term. The vulnerability requires user interaction (a victim must click a crafted link), which reduces its practical exploitability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the JustClick registration plugin (justclick-subscriber) version 0.1 or earlier, using tools like WPScan or by checking plugin metadata in publicly accessible readme.txt files.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin page where PHP_SELF is reflected, appending a script payload in the URL path — for example: https://target-site.com/wp-content/plugins/justclick-subscriber/justclick.php/<script>alert(document.cookie)</script>.
3. Deliver the link: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedded in a forum post or comment.
4. Payload execution: When the victim clicks the link and loads the page, the unsanitized PHP_SELF value is rendered into the HTML response, causing the injected script to execute in the victim's browser.
5. Achieve objective: Use the executed script to steal session cookies, capture credentials, redirect the user to a phishing page, or perform actions on the WordPress site on behalf of the victim (WordPress Plugin Repo, Wordfence).

• Network: HTTP requests to the JustClick plugin PHP file (/wp-content/plugins/justclick-subscriber/justclick.php) containing URL-encoded script tags or JavaScript payloads in the path component (e.g., %3Cscript%3E, <script>, javascript:).
• Logs: Web server access logs showing GET requests to justclick.php with anomalous path segments containing HTML/JavaScript injection strings; referrer headers pointing to external or unknown domains.
• File System: No file-system changes are expected for reflected XSS; however, monitor for any new or modified files in the plugin directory that could indicate follow-on compromise.
• Browser/Application: Unexpected JavaScript execution or redirects reported by users after clicking links related to the WordPress site's registration pages.

The recommended remediation is to deactivate and remove the JustClick registration plugin (justclick-subscriber), as no patched version beyond 0.1 has been released as of the disclosure date. Site administrators should monitor the WordPress plugin repository for an updated version that addresses the PHP_SELF sanitization issue. As a general workaround, a Web Application Firewall (WAF) can be configured to block requests containing script injection patterns in URL paths targeting the plugin (Wordfence).

Wordfence included CVE-2025-13676 in its weekly WordPress vulnerability report for the period of January 19–25, 2026, as part of routine disclosure coverage. No notable independent researcher commentary, vendor statements beyond the Wordfence advisory, or significant social media discussion has been identified for this vulnerability (Wordfence Blog).