CVE-2025-13604

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13604", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-24T13:50:44.912Z", "datePublished": "2025-12-09T04:36:24.520Z", "dateUpdated": "2026-04-08T16:40:45.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:40:45.755Z"}, "affected": [{"vendor": "cleantalk", "product": "Login Security, FireWall, Malware removal by CleanTalk", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.168", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-11-12T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-25T15:37:40.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-08T16:28:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T15:01:13.566213Z", "id": "CVE-2025-13604", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T15:01:18.781Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13604", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T15:01:13.566213Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T15:01:15.885Z"}}], "cna": {"title": "Login Security, FireWall, Malware removal by CleanTalk <= 2.168 - Unauthenticated Stored Cross-Site Scripting via Page URL", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "cleantalk", "product": "Login Security, FireWall, Malware removal by CleanTalk", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.168"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-25T15:37:40.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-08T16:28:49.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342"}], "descriptions": [{"lang": "en", "value": "The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-09T04:36:24.520Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13604", "state": "PUBLISHED", "dateUpdated": "2025-12-09T15:01:18.781Z", "dateReserved": "2025-11-24T13:50:44.912Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-09T04:36:24.520Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Login Security, FireWall, Malware removal by CleanTalk", "vendor": "cleantalk", "versions": [{"lessThanOrEqual": "2.168", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin de Login Security, Cortafuegos, Eliminaci\u00f3n de Malware de CleanTalk para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de la URL de la p\u00e1gina en todas las versiones hasta la 2.168, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13604", "lastModified": "2026-10-15T21:10:00.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13604", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T15:01:13.566213Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:35.473", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:52:49.362834+00:00", "value": {"mitigation_remediation": ["Upgrade the CleanTalk plugin to the latest release (any version greater than 2.168); the update removes the stored XSS flaw.", "If an upgrade cannot be performed immediately, disable or remove the plugin\u2019s page URL handling feature to prevent further storage of malicious scripts.", "Continuously monitor site traffic for suspicious URL patterns or attempts to exploit the plugin and enforce web\u2011application firewall rules to reject anomalous requests."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has the Login Security, FireWall, Malware removal by CleanTalk plugin installed in a version up to and including 2.168 is affected. Sites using newer releases or without the plugin are not impacted.", "description_and_impact": "The vulnerability lies in the CleanTalk WordPress plugin for versions up to 2.168, where an unauthenticated user can embed arbitrary scripts into a page URL. The plugin stores and later renders this URL without proper sanitization or escaping, causing the injected script to execute in the browsers of any visitor who accesses the affected page. This stored XSS can lead to session hijacking, credential theft, defacement, or malware installation on the client side, reflecting a classic CW-79 weakness.", "risk_and_exploitability": "With a CVSS score of 7.2, the flaw is considered high severity, affecting confidentiality, integrity, and availability of the web application. The EPSS score of less than 1% indicates low current exploitation rates, though the vulnerability is recognized in multiple advisories and is not listed in the CISA KEV catalog. Attackers can theoretically exploit the flaw by sending a crafted URL to the target; this is inferred from the description, as the entry does not explicitly detail the attack method. Because no authentication is required and the vulnerability is triggered by a simple request, it can be used in targeted or opportunistic attacks, especially against sites with significant user traffic."}}}}, "created": "2025-12-09T10:04:26.786014+00:00", "updated": "2026-04-22T21:00:06.363839+00:00", "vendors": ["cleantalk", "cleantalk$PRODUCT$security_&_malware_scan", "wordpress", "wordpress$PRODUCT$wordpress"]}