CVE-2025-13367

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13367", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-18T17:27:04.615Z", "datePublished": "2025-12-15T14:25:09.661Z", "dateUpdated": "2026-04-08T16:41:39.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:39.192Z"}, "affected": [{"vendor": "wpeverest", "product": "User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.4.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-11-09T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-18T17:42:26.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T02:13:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:42:33.985577Z", "id": "CVE-2025-13367", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:45:38.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:42:33.985577Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:42:35.164Z"}}], "cna": {"title": "User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpeverest", "product": "User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-09T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-18T17:42:26.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T02:13:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php"}], "descriptions": [{"lang": "en", "value": "The User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:39.192Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13367", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:39.192Z", "dateReserved": "2025-11-18T17:27:04.615Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-15T14:25:09.661Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "vendor": "wpeverest", "versions": [{"lessThanOrEqual": "4.4.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin User Registration & Membership - Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de m\u00faltiples atributos de shortcode en todas las versiones hasta la 4.4.6, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13367", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13367", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:42:33.985577Z", "version": "2.0.3"}}]}, "published": "2025-12-15T15:15:48.187", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:31:17.462427+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to version 4.4.7 or later, which removes the vulnerable shortcode attributes.", "If an upgrade is not immediately possible, delete or disable the shortcodes that expose unsanitized attributes, or sanitize the attribute values to prevent script injection.", "Limit contributor\u2011level access to trusted users only, or replace contributor with a custom role that has no ability to edit or add shortcodes."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in all released versions of the plugin up to and including 4.4.6. It affects installations that have the plugin enabled within a WordPress site and rely on the shortcodes that expose unsecured attributes.", "description_and_impact": "The WordPress plugin User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership contains stored XSS flaws in several shortcode attributes. An attacker who has contributor level access or higher can store malicious scripts that execute automatically in any browser that views a page containing the affected shortcode. This can allow session hijacking, credential theft, defacement, or the delivery of malware to site visitors.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate impact, but the EPSS score of < 1% suggests that actual exploitation is unlikely at the moment. The flaw is not listed in CISA\u2019s KEV catalog, so there is no evidence of active widespread exploitation. However, because the exploit requires contributor\u2011level rights, the risk escalates if an organization has many users with such privileges or if role permissions are not tightly controlled."}}}}, "created": "2025-12-15T21:33:26.089069+00:00", "updated": "2026-04-22T20:45:27.079548+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpeverest", "wpeverest$PRODUCT$user_registration", "wpeverest$PRODUCT$user_registration_&_membership"]}