CVE-2025-13907: 
WordPress vulnerability analysis and mitigation

CVE-2025-13907 is a Stored Cross-Site Scripting (XSS) vulnerability in the CSS3 Buttons plugin for WordPress, affecting all versions up to and including 0.1. The flaw exists in the plugin's button shortcode due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. It was published on December 6, 2025, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability resides in the plugin's shortcode handler at css3-buttons.php (line 59), where user-supplied attributes passed to the [button] shortcode are neither sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [button] shortcode with embedded JavaScript, which executes in the browser of any user who subsequently visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers when they visit an injected page, impacting both confidentiality and integrity (CVSS C:L/I:L). This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. Because the injected script persists in stored content, every subsequent visitor to the affected page is at risk, potentially enabling account takeover of higher-privileged users such as administrators (Red Hat CVE, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13907 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the CSS3 Buttons plugin version 0.1 or earlier. This can be done by checking the plugin's readme or version file at /wp-content/plugins/css3-buttons/readme.txt.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [button] shortcode with a malicious attribute payload, for example: [button link="javascript:void(0)" class="\" onmouseover=\"alert(document.cookie)"]Click Me[/button] or similar XSS payloads embedded in unsanitized attributes.
4. Publish the content: Submit the post or page for publication (contributors may require editor approval, but editors/admins reviewing the draft would also trigger execution).
5. Trigger execution: When any authenticated or unauthenticated user visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing [button] shortcode content with encoded JavaScript or event handler attributes (e.g., onerror, onmouseover, javascript:).
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing [button] shortcodes with suspicious attribute values.
• Network: Outbound requests from victim browsers to unknown external domains following page visits, potentially indicating data exfiltration via injected scripts.
• Logs: WordPress audit logs (if enabled via plugins such as WP Activity Log) recording post creation or editing by contributor-level accounts with unusual shortcode content.

As of the available data, no patched version of the CSS3 Buttons plugin beyond 0.1 has been confirmed. Site administrators should immediately deactivate and remove the CSS3 Buttons plugin (all versions ≤ 0.1) until a patched release is available. As a workaround, restrict contributor-level user registration and review all existing posts/pages for malicious [button] shortcode content. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection (Wordfence).

The vulnerability was reported and assigned by Wordfence, a leading WordPress security firm, and has been indexed by multiple vulnerability tracking platforms including ENISA EUVD, CIRCL, and VulDB. Social media activity is minimal, with only a small number of automated posts on Bluesky referencing the CVE. No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries (Wordfence).