{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13617", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T19:51:51.661Z", "datePublished": "2026-02-19T04:36:12.110Z", "dateUpdated": "2026-04-08T16:54:13.416Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:13.416Z"}, "affected": [{"vendor": "apollo13themes", "product": "Apollo13 Framework Extensions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018a13_alt_link\u2019 parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56be227d-1273-4833-a94e-67abf89f00ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/apollo13-framework-extensions/trunk/features/permalinks.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3410555%40apollo13-framework-extensions&new=3410555%40apollo13-framework-extensions&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-11-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-18T15:32:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:03:46.431811Z", "id": "CVE-2025-13617", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:37:22.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13617", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:03:46.431811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:03:48.108Z"}}], "cna": {"title": "Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "apollo13themes", "product": "Apollo13 Framework Extensions", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-18T15:32:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56be227d-1273-4833-a94e-67abf89f00ba?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/apollo13-framework-extensions/trunk/features/permalinks.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3410555%40apollo13-framework-extensions&new=3410555%40apollo13-framework-extensions&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018a13_alt_link\u2019 parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:13.416Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13617", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:13.416Z", "dateReserved": "2025-11-24T19:51:51.661Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T04:36:12.110Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Apollo13 Framework Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018a13_alt_link\u2019 parameter in all versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Apollo13 Framework Extensions para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'a13_alt_link' en todas las versiones hasta la 1.9.8, inclusive, debido a una sanitizaci\u00f3n insuficiente de la entrada y un escape de la salida inadecuado. Esto permite a atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13617", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-19T07:17:32.510", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/apollo13-framework-extensions/trunk/features/permalinks.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3410555%40apollo13-framework-extensions&new=3410555%40apollo13-framework-extensions&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56be227d-1273-4833-a94e-67abf89f00ba?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.9.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apollo13 Framework Extensions", "source": "cna", "vendor": "apollo13themes"}, "product": "apollo13_framework_extensions", "vendor": "apollo13themes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-21T15:56:09.123056+00:00", "value": {"mitigation_remediation": ["Update the Apollo13 Framework Extensions plugin to the latest available version (\u22651.9.9) which removes the flaw.", "If an update cannot be applied immediately, disable or uninstall the plugin to eliminate the stored\u2011XSS vector.", "Review WordPress user roles and reduce contributor privileges where possible, applying the principle of least privilege to limit script injection.", "Deploy a web\u2011application firewall or run a security scan to detect and block any residual script payloads."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Apollo13 Framework Extensions plugin, versions 1.9.8 and earlier, are vulnerable. The affected product is the Apollo13 themes Apollo13 Framework Extensions, with the specific vulnerability present through version 1.9.8 inclusive. No other versions or plugins are cited as affected.", "description_and_impact": "The Apollo13 Framework Extensions plugin for WordPress contains a stored cross\u2011site scripting flaw in its a13_alt_link parameter. Because the value is neither sufficiently validated nor properly escaped before being saved and later rendered, an authenticated user with Contributor privileges or higher can inject arbitrary JavaScript. When an affected page is viewed, the injected script executes in the context of any visitor, enabling session hijacking, defacement, or other client\u2011side attacks as described by CWE\u201179.", "risk_and_exploitability": "The CVSS base score is 6.4, indicating a medium risk stored XSS. The EPSS score is less than 1\u202f%, signaling that, at the time of evaluation, the exploitation probability is low, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be an authenticated user with contributor-level access, which provides the necessary privileges to create the malicious payload. Once stored, the script executes automatically for any visitor, creating a persistent attack vector that can be leveraged repeatedly until the plugin is mitigated."}}}}, "created": "2026-02-19T10:07:14.734566+00:00", "updated": "2026-04-21T16:00:13.283341+00:00", "vendors": ["apollo13themes", "apollo13themes$PRODUCT$apollo13_framework_extensions", "wordpress", "wordpress$PRODUCT$wordpress"]}