{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13969", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T15:31:24.261Z", "datePublished": "2025-12-12T03:20:49.620Z", "dateUpdated": "2026-04-08T17:01:15.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:15.115Z"}, "affected": [{"vendor": "eurisko", "product": "Reviews Sorted", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74e790e7-60fd-45cd-942f-0f24365d7fc8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/functions/do.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/functions/do.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-1.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-1.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-2.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-2.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-3.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-3.php#L23"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2025-12-11T14:22:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-12T20:18:17.439300Z", "id": "CVE-2025-13969", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:14:10.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13969", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:18:17.439300Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-12T20:19:05.726Z"}}], "cna": {"title": "Reviews Sorted <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "eurisko", "product": "Reviews Sorted", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T14:22:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74e790e7-60fd-45cd-942f-0f24365d7fc8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/functions/do.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/functions/do.php#L138"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-1.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-1.php#L30"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-2.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-2.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-3.php#L23"}, {"url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-3.php#L23"}], "descriptions": [{"lang": "en", "value": "The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:15.115Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13969", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:15.115Z", "dateReserved": "2025-12-03T15:31:24.261Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:49.620Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-13969", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-12T04:15:44.817", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/functions/do.php#L138"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-1.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-2.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider-3.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/tags/2.4.2/templates/reviews-slider.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/functions/do.php#L138"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-1.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-2.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider-3.php#L23"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/reviews-sorted/trunk/templates/reviews-slider.php#L23"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/74e790e7-60fd-45cd-942f-0f24365d7fc8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:27:26.180152+00:00", "value": {"mitigation_remediation": ["Update the Reviews Sorted plugin to version 2.4.3 or newer, which removes the vulnerable handling of the 'space' attribute.", "If an upgrade is not possible, consider disabling or deleting the [reviews-slider] shortcode or uninstalling the plugin to eliminate the injection vector.", "As a temporary measure, restrict Contributor+ role permissions from adding or editing shortcodes until the plugin is patch\u2011fixed or removed."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites running Reviews Sorted version 2.4.2 or earlier, produced by eurisko:Reviews Sorted.", "description_and_impact": "The Reviews Sorted plugin for WordPress suffers from stored cross\u2011site scripting in all releases up to 2.4.2. An authenticated user with Contributor level or higher can embed malicious script code through the 'space' attribute of the [reviews-slider] shortcode, which is then rendered and executed in the browsers of visitors who view the affected page. The flaw is caused by insufficient input sanitization and a lack of output escaping, enabling attackers to steal session cookies, deface content, or launch further attacks.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating medium severity, and an EPSS score of less than 1%, suggesting a low current exploitation probability. It is not listed in the CISA KEV catalog, so no public exploits are known. However, the requirement for authenticated Contributor+ access means any site granting such roles is at risk, and exploitation could affect all users who view injected content."}}}}, "created": "2025-12-12T08:47:52.074662+00:00", "updated": "2026-04-21T17:30:37.702184+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}