{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13959", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T14:47:40.499Z", "datePublished": "2026-02-18T04:35:42.408Z", "dateUpdated": "2026-04-08T16:42:56.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:56.103Z"}, "affected": [{"vendor": "shanaver", "product": "Filestack", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2777794d-2c0a-4843-bed8-78e607d4e796?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/trunk/lib/shortcodes.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/tags/2.0.8/lib/shortcodes.php#L20"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2026-02-17T16:17:30.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T14:43:27.907372Z", "id": "CVE-2025-13959", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:43:40.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13959", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T14:43:27.907372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T14:43:34.447Z"}}], "cna": {"title": "Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shanaver", "product": "Filestack", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-17T16:17:30.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2777794d-2c0a-4843-bed8-78e607d4e796?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/trunk/lib/shortcodes.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/tags/2.0.8/lib/shortcodes.php#L20"}], "descriptions": [{"lang": "en", "value": "The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:56.103Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13959", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:56.103Z", "dateReserved": "2025-12-03T14:47:40.499Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T04:35:42.408Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Filestack para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'filepicker' del plugin en todas las versiones hasta la 2.0.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13959", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-02-18T05:16:17.633", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/tags/2.0.8/lib/shortcodes.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/filepicker-media-uploader/trunk/lib/shortcodes.php#L20"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2777794d-2c0a-4843-bed8-78e607d4e796?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Filestack", "source": "cna", "vendor": "shanaver"}, "product": "filestack", "vendor": "shanaver"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-22T15:28:08.240339+00:00", "value": {"mitigation_remediation": ["Upgrade the Filestack plugin to the latest release (v2.0.9 or newer), which removes the stored XSS vulnerability.", "If an upgrade is not feasible, disable or restrict the 'filepicker' shortcode so that only administrators can use it, or remove the shortcode from any public posts.", "Audit existing content for injected scripts and manually remove any malicious code; ensure that any input handling sanitizes and escapes shortcode attributes before rendering."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) in Filestack plugin"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Filestack plugin version 2.0.8 or earlier are affected. Any installations that have the 'filepicker' shortcode enabled and permit contributor\u2011level users to insert content are at risk. The plugin vendor is shanaver, and the vulnerability has been observed in all releases up to and including 2.0.8.", "description_and_impact": "The Filestack plugin for WordPress is vulnerable to stored cross\u2011site scripting through the 'filepicker' shortcode. Unescaped attributes supplied by authenticated users with contributor or higher roles can be stored and later rendered as part of page content, allowing an attacker to inject arbitrary JavaScript that runs in the browsers of any visitor that loads the affected page. This flaw arises from insufficient input sanitization and output escaping and is classified as CWE\u201179.", "risk_and_exploitability": "The CVSS score is 6.4, indicating a medium severity risk. The EPSS score is less than 1%, suggesting that exploitation is relatively rare but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access, specifically contributors or higher, and involves inserting malicious attributes into the shortcode which are then stored and rendered. If successful, the injected script will execute when any site visitor views the affected page, potentially compromising their credentials, defacing content, or facilitating broader attacks. Based on the description, it is inferred that the attack vector is authenticated."}}}}, "created": "2026-02-18T10:32:58.716158+00:00", "updated": "2026-04-22T15:30:20.781960+00:00", "vendors": ["shanaver", "shanaver$PRODUCT$filestack", "wordpress", "wordpress$PRODUCT$wordpress"]}