CVE-2025-13989: 
WordPress vulnerability analysis and mitigation

CVE-2025-13989 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Dropzone plugin for WordPress, affecting all versions up to and including 1.1.1. The flaw exists in the callback shortcode attribute, which is insufficiently sanitized and evaluated as JavaScript via the new Function() constructor. It was published on December 12, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from insufficient input sanitization and output escaping on the user-supplied callback attribute of the WP Dropzone shortcode. The vulnerable attribute value is passed directly into a new Function() constructor in the plugin's JavaScript (wp-dropzone.js, line 86), allowing arbitrary JavaScript execution in the browser of any visitor who loads the affected page. Exploitation requires only Contributor-level WordPress authentication, as contributors can insert shortcodes into posts or pages. The vulnerable server-side handling is visible in class-plugin.php at line 303 (Wordfence, Plugin Source).

Successful exploitation allows an authenticated attacker with Contributor-level access to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of all users who visit the affected page. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially escalating to full site compromise if an admin account is hijacked. Confidentiality and integrity are both impacted at a low level per the CVSS scoring, with no direct availability impact (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13989 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running WP Dropzone ≤ 1.1.1.
2. Create or Edit a Post: Navigate to the WordPress editor and create or edit a post/page where shortcodes are permitted.
3. Inject Malicious Shortcode: Insert the WP Dropzone shortcode with a crafted callback attribute containing malicious JavaScript, e.g., [wp_dropzone callback="alert(document.cookie)"] or a more sophisticated payload such as a cookie-stealing script.
4. Publish the Page: Submit or publish the post so the injected shortcode is stored in the database.
5. Trigger Execution: When any user (including administrators) visits the page, the plugin renders the shortcode and passes the callback value into a new Function() constructor in wp-dropzone.js, executing the attacker's JavaScript in the victim's browser.
6. Achieve Objective: Harvest session tokens, redirect victims, or perform actions on behalf of the victim user — potentially escalating to admin-level compromise if an administrator visits the page (Wordfence, Plugin Source).

• Logs: WordPress post/page content containing [wp_dropzone shortcodes with unusual or encoded callback attribute values; audit log entries showing Contributor-level users editing pages with shortcode content.
• File System: No direct file system changes expected for this stored XSS; however, if the XSS is used to deliver a web shell or malicious plugin, look for unexpected PHP files in wp-content/uploads/ or wp-content/plugins/.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages hosting the WP Dropzone shortcode; unusual JavaScript resource loads from third-party domains on affected pages.
• Database: WordPress wp_posts table entries containing [wp_dropzone shortcodes with callback values including <script>, new Function, encoded payloads, or external URLs (Wordfence).

Site administrators should update the WP Dropzone plugin to a version beyond 1.1.1 if a patched release is available, or deactivate and remove the plugin until a fix is confirmed. As a workaround, restrict the ability to use shortcodes to trusted roles only (Editor or Administrator), removing Contributor-level shortcode access where possible. Regularly audit WordPress user roles and review post content for unexpected shortcode usage (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for December 8–14, 2025, noting it as a stored XSS with a patch available (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.