CVE-2025-13728: 
WordPress vulnerability analysis and mitigation

CVE-2025-13728 is a Stored Cross-Site Scripting (XSS) vulnerability in the FluentAuth – The Ultimate Authorization & Security Plugin for WordPress. It affects all versions up to and including 2.0.3, where insufficient input sanitization and output escaping on user-supplied attributes in the fluent_auth_reset_password shortcode allow authenticated attackers with contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on December 15, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) by Wordfence (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically due to insufficient input sanitization and output escaping on user-supplied attributes passed to the fluent_auth_reset_password shortcode in the plugin's CustomAuthHandler.php (Wordfence). An authenticated attacker with at least contributor-level WordPress access can embed a malicious shortcode containing arbitrary JavaScript into a page or post. When any user visits the affected page, the injected script executes in their browser context. The fix was introduced in version 2.1.0, as reflected in the plugin's changeset for CustomAuthHandler.php (WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected shortcode, affecting confidentiality and integrity. This can lead to session cookie theft, credential harvesting, account takeover of higher-privileged users (including administrators), and defacement of site content. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress site and its users (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-13728. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a site running FluentAuth ≤ 2.0.3.
2. Create or Edit a Page/Post: Navigate to the WordPress editor and create a new page or post, or edit an existing one where the contributor has edit rights.
3. Inject Malicious Shortcode: Insert the fluent_auth_reset_password shortcode with a crafted attribute containing a malicious JavaScript payload, for example: [fluent_auth_reset_password attribute="\">"].
4. Publish the Content: Submit or publish the page/post so the injected shortcode is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the affected page, the browser renders the shortcode output and executes the injected JavaScript, enabling session hijacking, credential theft, or further malicious actions (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from contributor-level accounts containing shortcode content with unusual attribute values or encoded JavaScript.
• Database: WordPress wp_posts table entries containing the fluent_auth_reset_password shortcode with unexpected or encoded attribute values (e.g., <script>, javascript:, onerror=, or base64-encoded strings).
• Network: Outbound requests from victim browsers to unknown external domains following page visits, potentially indicating data exfiltration (e.g., cookie or session token theft via document.cookie).
• File System: Unexpected modifications to CustomAuthHandler.php or other plugin files if an attacker escalated to file write access after initial XSS exploitation.

Site administrators should update the FluentAuth plugin to version 2.1.0 or later, which addresses the insufficient sanitization in CustomAuthHandler.php (WordPress Trac). As an interim measure, restrict contributor-level user registrations and limit the ability of untrusted users to publish or edit pages containing shortcodes. A Web Application Firewall (WAF) with XSS filtering rules can also help detect and block exploitation attempts while patching is pending (Wordfence).

Wordfence, the CNA that assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026 (Wordfence Blog). The vulnerability received standard coverage from vulnerability aggregators such as VulDB, Vulners, and CVEFeed, with no notable broader media coverage or significant social media discussion observed.