CVE-2025-13903: 
WordPress vulnerability analysis and mitigation

CVE-2025-13903 is a Stored Cross-Site Scripting (XSS) vulnerability in the PullQuote plugin for WordPress, affecting all versions up to and including 1.0. The flaw arises from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's pullquote shortcode. It was published on January 9, 2026, and reported by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS variant. The vulnerability exists in the plugin's shortcode handler (includes/core.php, line 12), where attributes passed to the [pullquote] shortcode are neither sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at least contributor-level access can embed a malicious JavaScript payload as a shortcode attribute in a post or page; the script executes in the browser of any visitor who loads the affected content. No user interaction beyond page visitation is required for the payload to trigger (Wordfence, Plugin Source).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any visitor's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of drive-by malware to site visitors. The scope is changed (affecting users beyond the attacker's own session), with low confidentiality and integrity impact and no direct availability impact (Wordfence).

The vulnerability requires authenticated access at the contributor level or above, which limits opportunistic exploitation but remains a realistic threat on multi-author WordPress sites. No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the PullQuote plugin (version ≤ 1.0) by checking plugin listings or using tools like WPScan.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [pullquote] shortcode with a malicious attribute, e.g., [pullquote attribute="\"onmouseover=\"alert(document.cookie)"]Quoted text[/pullquote] or an equivalent XSS payload embedded in an unescaped attribute.
4. Publish or submit for review: Save or publish the post. On sites where contributors can submit for review, the payload may be stored even without immediate publication.
5. Payload execution: When any site visitor (including administrators) loads the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing pullquote shortcode content with JavaScript event handlers (e.g., onerror, onmouseover, <script>) or encoded XSS payloads.
• Database: Unexpected JavaScript or HTML event handler strings stored in wp_posts content fields associated with [pullquote] shortcode usage.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages containing the pullquote shortcode, potentially indicating data exfiltration (e.g., cookie theft via document.location redirects).
• File System: No direct file system artifacts expected for this stored XSS; however, review wp-content/plugins/pullquote/includes/core.php for unauthorized modifications.

Site administrators should update the PullQuote plugin to a version beyond 1.0 that includes proper input sanitization and output escaping, if such a version has been released by the vendor (ctietze). If no patched version is available, the recommended workaround is to deactivate and remove the PullQuote plugin entirely. Additionally, restrict contributor-level access to trusted users only, and consider deploying a Web Application Firewall (WAF) with XSS filtering rules as a compensating control (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on January 9, 2026. Coverage has been limited to automated vulnerability aggregators (VulDB, Vulners, CVEFeed) and a brief post on Bluesky. No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond the initial Wordfence disclosure.