{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13853", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-01T20:21:37.258Z", "datePublished": "2026-01-09T09:19:47.232Z", "dateUpdated": "2026-04-08T17:06:14.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:06:14.716Z"}, "affected": [{"vendor": "lnbadmin1", "product": "Nearby Now Reviews", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc991ea-0d00-4734-9b9a-5af759e83540?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/trunk/nn-reviews.php#L160"}, {"url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/tags/5.2/nn-reviews.php#L160"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-01-08T21:19:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T17:06:21.298630Z", "id": "CVE-2025-13853", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T17:06:28.658Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13853", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T17:06:21.298630Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T17:06:24.107Z"}}], "cna": {"title": "Nearby Now Reviews <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "lnbadmin1", "product": "Nearby Now Reviews", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-08T21:19:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc991ea-0d00-4734-9b9a-5af759e83540?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/trunk/nn-reviews.php#L160"}, {"url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/tags/5.2/nn-reviews.php#L160"}], "descriptions": [{"lang": "en", "value": "The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-09T09:19:47.232Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13853", "state": "PUBLISHED", "dateUpdated": "2026-01-09T17:06:28.658Z", "dateReserved": "2025-12-01T20:21:37.258Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T09:19:47.232Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Nearby Now Reviews para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'data_tech' del shortcode nn-tech en todas las versiones hasta la 5.2, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13853", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-09T10:15:45.770", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/tags/5.2/nn-reviews.php#L160"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/nearby-now-reviews/trunk/nn-reviews.php#L160"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8dc991ea-0d00-4734-9b9a-5af759e83540?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:31:38.654306+00:00", "value": {"mitigation_remediation": ["Update the Nearby Now Reviews plugin to the newest available release that removes the vulnerable attribute handling; if no newer version exists, disable the plugin or uninstall it.", "Limit user accounts with the Contributor role to administrators or other trusted personnel, and remove or downgrade the capability set for untrusted contributors.", "Implement a strict Content Security Policy that disallows inline scripts and restricts the sources of scripts to trusted domains; this can mitigate the impact of any stored script if the plugin cannot be removed immediately."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via shortcode attributes"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all releases of the Nearby Now Reviews plugin from the vendor lnbadmin1 up to and including version\u202f5.2. No later releases are affected according to the current data.", "description_and_impact": "The Nearby Now Reviews WordPress plugin accepts a shortcode attribute named data_tech that is stored without proper sanitization or escaping. Authenticated users with the Contributor role or higher can supply arbitrary script content in this attribute, which is later rendered in other site pages. An attacker can inject malicious JavaScript that executes in the browsers of visitors to those pages, potentially enabling cookie theft, session hijacking, defacement, or the execution of arbitrary actions on behalf of the user. The weakness is an example of input handling flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS probability is less than 1\u202f%, which suggests that exploitation is unlikely but not impossible. The issue is not listed in the CISA KEV catalog. Because the flaw requires an authenticated account with Contributor-level privileges, an attacker must first compromise or impersonate a legitimate user with sufficient rights to inject the payload. Once the payload is stored, it will execute for any visitor of the affected page, creating a persistent threat in the environment."}}}}, "created": "2026-01-09T13:23:38.874113+00:00", "updated": "2026-04-21T16:45:15.209486+00:00", "vendors": ["lnbadmin1", "lnbadmin1$PRODUCT$nearby_now_reviews", "wordpress", "wordpress$PRODUCT$wordpress"]}