{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13989", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-03T17:07:46.188Z", "datePublished": "2025-12-12T03:20:41.677Z", "dateUpdated": "2026-04-08T16:41:56.863Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:56.863Z"}, "affected": [{"vendor": "nazsabuz", "product": "WP Dropzone", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied 'callback' attributes, which are evaluated as JavaScript code via the `new Function()` constructor. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23953909-4836-4226-b00b-eb0e24cc3ad7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/includes/class-plugin.php#L303"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/js/wp-dropzone.js#L86"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/includes/class-plugin.php#L303"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/js/wp-dropzone.js#L86"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "timeline": [{"time": "2025-12-11T15:09:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T18:07:42.912025Z", "id": "CVE-2025-13989", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:16:39.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T18:07:42.912025Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T18:07:45.367Z"}}], "cna": {"title": "WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "nazsabuz", "product": "WP Dropzone", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T15:09:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23953909-4836-4226-b00b-eb0e24cc3ad7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/includes/class-plugin.php#L303"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/js/wp-dropzone.js#L86"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/includes/class-plugin.php#L303"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/js/wp-dropzone.js#L86"}], "descriptions": [{"lang": "en", "value": "The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied 'callback' attributes, which are evaluated as JavaScript code via the `new Function()` constructor. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:56.863Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13989", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:56.863Z", "dateReserved": "2025-12-03T17:07:46.188Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-12T03:20:41.677Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied 'callback' attributes, which are evaluated as JavaScript code via the `new Function()` constructor. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-13989", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-12T04:15:45.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/includes/class-plugin.php#L303"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/tags/1.1.1/js/wp-dropzone.js#L86"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/includes/class-plugin.php#L303"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-dropzone/trunk/js/wp-dropzone.js#L86"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23953909-4836-4226-b00b-eb0e24cc3ad7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:51:39.765497+00:00", "value": {"mitigation_remediation": ["Update WP Dropzone to the latest available version, or at minimum to a release newer than 1.1.1", "If an update is not possible, remove the or disable the 'callback' shortcode attribute in all posts and exclude user\u2011supplied values from the function constructor", "Sanitize all user input and escape output when processing shortcode attributes to prevent arbitrary JavaScript execution, following best practices for XSS mitigations"], "summary": {"action": "Immediate patch", "impact": "Stored cross\u2011site scripting"}, "threat_synthesis": {"affected_systems": "All installations of the WP Dropzone plugin from its initial release up to and including version\u202f1.1.1 are vulnerable. The plugin is distributed by nazsabuz and operates within WordPress sites that permit Contributors or higher to edit content. Updating the plugin to a release newer than\u202f1.1.1 removes the flaw, or disabling the \"callback\" attribute entirely resolves the risk.", "description_and_impact": "The WP Dropzone plugin for WordPress allows authenticated users with Contributor or higher permissions to embed a \"callback\" attribute in shortcode tags. The plugin fails to sanitize or escape the value of this attribute before evaluating it via JavaScript\u2019s `new Function()` constructor. Because the value is persisted in the database, every subsequent page view that includes the shortcode executes the attacker\u2011supplied JavaScript. The stored XSS flaw can be used to steal session cookies, deface content, or deliver other client\u2011side attacks when any user visits the affected page.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1\u202f% suggests a low probability of widespread exploitation at the present time. The vulnerability is not listed in CISA\u2019s KEV catalog, which further implies limited known exploitation. Attackers must first gain authenticated Contributor\u2011level access, then insert a malicious callback value into a post or page using the shortcode. Once stored, the payload is executed whenever a visitor loads the affected content, making the exploitation straightforward once the initial privilege is achieved."}}}}, "created": "2025-12-12T08:48:31.771245+00:00", "updated": "2026-04-22T21:00:06.358798+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}