CVE-2025-13740: 
WordPress vulnerability analysis and mitigation

CVE-2025-13740 is a Stored Cross-Site Scripting (XSS) vulnerability in the Lightweight Accordion plugin for WordPress, affecting all versions up to and including 1.5.20. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the lightweight-accordion shortcode. It was published on December 15, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant. Authenticated attackers with contributor-level access or higher can embed malicious JavaScript payloads within the lightweight-accordion shortcode attributes when creating or editing posts/pages. Because the plugin fails to properly sanitize input or escape output before rendering, the injected script is stored server-side and executes in the browsers of any user who subsequently visits the affected page. A patch was applied in changeset 3413649 of the WordPress plugin repository (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session when they visit a page containing the injected shortcode. This can lead to session token theft, credential harvesting, defacement of page content, redirection to malicious sites, or further attacks against site administrators (potentially enabling privilege escalation to full site compromise). The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users, though availability is not directly impacted (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13740. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site (e.g., via open registration, phishing, or credential stuffing).
2. Create or Edit a Post/Page: Navigate to the WordPress editor and create a new post or edit an existing one that allows shortcode usage.
3. Inject Malicious Shortcode: Insert the lightweight-accordion shortcode with a crafted attribute containing a JavaScript payload, for example: [lightweight-accordion title="<img src=x onerror=alert(document.cookie)>"]Content[/lightweight-accordion].
4. Publish the Content: Submit or update the post/page so the malicious shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing encoded or obfuscated script tags within shortcode parameters.
• Database: Entries in the wp_posts table containing lightweight-accordion shortcodes with unexpected HTML attributes such as onerror, onload, <script>, or JavaScript URIs (javascript:).
• Network: Outbound requests from victim browsers to unfamiliar external domains following page visits, potentially indicating data exfiltration (e.g., cookie theft via document.cookie sent to attacker-controlled endpoints).
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified PHP files in the plugin directory that could indicate follow-on compromise.

Site administrators should update the Lightweight Accordion plugin to version 1.5.21 or later, which includes the fix applied in WordPress plugin repository changeset 3413649. As an interim measure, restrict contributor-level user registration and limit shortcode usage to trusted roles if the plugin cannot be immediately updated. Deploying a Web Application Firewall (WAF) with XSS filtering rules can also help mitigate exploitation attempts (Wordfence, WordPress Trac).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report covering December 8–14, 2025, and assigned the CVE through their threat intelligence program (Wordfence Blog). The vulnerability was also tracked by ENISA's EUVD database (EUVD-2025-203329) and noted by INCIBE-CERT. Community reaction has been minimal given the medium severity and authentication requirement, with no notable social media discussion or researcher commentary beyond standard aggregator coverage.