{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13531", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-21T20:34:04.049Z", "datePublished": "2026-01-07T08:21:51.005Z", "dateUpdated": "2026-04-08T16:44:13.789Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:13.789Z"}, "affected": [{"vendor": "hayyatapps", "product": "Stylish Order Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/functions-admin.php#L74"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/functions-admin.php#L74"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/Pages/manage-forms/includes/all-products.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/Pages/manage-forms/includes/all-products.php#L9"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sopon Tangpathum (SoNaJaa)"}], "timeline": [{"time": "2026-01-03T11:17:11.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T20:08:48.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:47:20.615707Z", "id": "CVE-2025-13531", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:12:40.378Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13531", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:47:20.615707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:47:23.074Z"}}], "cna": {"title": "Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Sopon Tangpathum (SoNaJaa)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hayyatapps", "product": "Stylish Order Form Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-03T11:17:11.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T20:08:48.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/functions-admin.php#L74"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/functions-admin.php#L74"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/Pages/manage-forms/includes/all-products.php#L9"}, {"url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/Pages/manage-forms/includes/all-products.php#L9"}], "descriptions": [{"lang": "en", "value": "The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T08:21:51.005Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13531", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:12:40.378Z", "dateReserved": "2025-11-21T20:34:04.049Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T08:21:51.005Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Stylish Order Form Builder para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'product_name' en todas las versiones hasta la 1.0, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13531", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-07T12:16:49.247", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/Pages/manage-forms/includes/all-products.php#L9"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/tags/1.0/functions-admin.php#L74"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/Pages/manage-forms/includes/all-products.php#L9"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/stylish-order-form-builder/trunk/functions-admin.php#L74"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:16:18.263087+00:00", "value": {"mitigation_remediation": ["Upgrade the Stylish Order Form Builder plugin to a version that includes proper input validation and output escaping for the product_name field", "Revoke or downgrade capabilities of the Subscriber role (or any role affected by the vulnerability) so that only administrators can add or edit products in the plugin", "Implement site\u2011wide XSS protection such as a web application firewall or security plugin that sanitizes user input on form submissions, ensuring that any script payload is neutralized before storage"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting exploited by authenticated users with Subscriber level or higher in the Stylish Order Form Builder plugin"}, "threat_synthesis": {"affected_systems": "This issue affects all releases of the Stylish Order Form Builder plugin by hayyatapps up to and including version 1.0. Versions beyond 1.0 have not been explicitly mentioned as fixed, but may still be impacted if sanitization changes have not been applied. WordPress sites running this plugin at any of these versions are at risk.", "description_and_impact": "The vulnerability occurs when the product_name field in the Stylish Order Form Builder plugin is stored without adequate input sanitization or output encoding, allowing attackers with subscriber\u2011level privileges to embed malicious scripts. The injected code executes in the context of any user who views the affected page, enabling theft of session cookies, defacement, or further exploitation. This is a classic stored XSS flaw (CWE-79).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that actual exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. However, the requirement for only subscriber\u2011level authentication means that a large portion of site users could perpetrate the attack, increasing the potential impact if compromised credentials exist. Attackers would need to log into the WordPress dashboard, navigate to product management, and submit a crafted product_name string to inject their payload."}}}}, "created": "2026-01-08T09:49:34.787630+00:00", "updated": "2026-04-22T20:30:26.766169+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}