CVE-2025-13958: 
WordPress vulnerability analysis and mitigation

CVE-2025-13958 is a Stored Cross-Site Scripting (XSS) vulnerability in the YaMaps for WordPress plugin affecting all versions before 0.6.40. The flaw allows authenticated users with the Contributor role or higher to inject malicious scripts via unsanitized shortcode attributes that are rendered in pages or posts. It was publicly disclosed on December 8, 2025, and assigned a CVSS v3.1 base score of 5.9 (Medium) (WPScan, Feedly).

The root cause is improper neutralization of user-controlled input in shortcode attributes (CWE-79). The YaMaps plugin fails to validate or escape shortcode attributes before rendering them in page or post output, allowing an attacker to embed arbitrary JavaScript. The publicly disclosed proof-of-concept payload demonstrates the technique: [yamap]}alert(document.cookie);function x(){[/yamap], which breaks out of the expected shortcode context and injects executable script content. Exploitation requires the attacker to have at least Contributor-level access to the WordPress site and a victim to view the affected page (WPScan).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who views the compromised page, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as privilege escalation or backdoor installation), and defacement of site content. The changed scope in the CVSS rating reflects that the impact extends beyond the attacker's own session to affect other users of the WordPress site (WPScan, Feedly).

A public proof-of-concept payload is available via WPScan. The vulnerability requires Contributor-level authentication, limiting opportunistic exploitation, but is straightforward to exploit once access is obtained. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.029% (0.000290), indicating low probability of near-term automated exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (WPScan, Feedly).

1. Gain Contributor Access: Obtain or register a WordPress account with at least the Contributor role on the target site running YaMaps plugin version below 0.6.40.
2. Create or Edit a Post: Navigate to the WordPress dashboard and create a new post or edit an existing draft that allows shortcode embedding.
3. Inject Malicious Shortcode: Insert the crafted payload into the post content, e.g., [yamap]}alert(document.cookie);function x(){[/yamap], which breaks out of the shortcode attribute context and injects JavaScript.
4. Publish or Submit for Review: Publish the post (or submit for review if contributor permissions require it), making the malicious content available to site visitors.
5. Harvest Victim Data: When an administrator or other user views the page, the injected script executes in their browser, potentially stealing session cookies, performing actions on their behalf, or redirecting them to attacker-controlled infrastructure (WPScan).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or wp-json/wp/v2/posts from Contributor-level accounts containing yamap shortcode patterns with JavaScript syntax (e.g., alert, document.cookie, <script>).
• File System: Unexpected modifications to post content in the WordPress database (wp_posts table) containing obfuscated or encoded JavaScript within [yamap] shortcode tags.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing YaMaps shortcodes, potentially indicating cookie exfiltration or beacon activity.
• Application: Browser console errors or unexpected JavaScript execution on pages embedding the YaMaps shortcode, particularly on sites running plugin versions below 0.6.40.

Update the YaMaps for WordPress plugin to version 0.6.40 or later, which introduces proper validation and escaping of shortcode attributes. As an interim workaround, restrict the Contributor role from creating or editing posts that embed the YaMaps shortcode, or temporarily disable the plugin until patching is feasible. Site administrators should audit existing posts for malicious shortcode payloads if Contributor-level accounts are used (WPScan).

The vulnerability was discovered and responsibly disclosed by researcher Alex Tselevich (nos3curity) of nosecurity.blog, who also submitted it to WPScan. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability database listings (WPScan).