CVE-2025-13728

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13728", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-25T23:03:10.530Z", "datePublished": "2025-12-15T14:25:12.270Z", "dateUpdated": "2026-04-08T17:12:47.745Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:12:47.745Z"}, "affected": [{"vendor": "techjewel", "product": "FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3187d3e-e1da-4af7-a1fa-9657389f9e22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3409232/fluent-security/tags/2.1.0/app/Hooks/Handlers/CustomAuthHandler.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-11-17T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-25T23:18:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-15T02:19:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:42:24.971692Z", "id": "CVE-2025-13728", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:45:16.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13728", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:42:24.971692Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:42:26.092Z"}}], "cna": {"title": "FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "techjewel", "product": "FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-25T23:18:43.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-15T02:19:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3187d3e-e1da-4af7-a1fa-9657389f9e22?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3409232/fluent-security/tags/2.1.0/app/Hooks/Handlers/CustomAuthHandler.php"}], "descriptions": [{"lang": "en", "value": "The FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-15T14:25:12.270Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13728", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:45:16.363Z", "dateReserved": "2025-11-25T23:03:10.530Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-15T14:25:12.270Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress", "vendor": "techjewel", "versions": [{"lessThanOrEqual": "2.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FluentAuth \u2013 The Ultimate Authorization & Security Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `fluent_auth_reset_password` shortcode in all versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin FluentAuth - The Ultimate Authorization & Security Plugin for WordPress para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode 'fluent_auth_reset_password' del plugin en todas las versiones hasta, e incluyendo, 2.0.3 debido a la sanitizaci\u00f3n de entrada y el escape de salida insuficientes en atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13728", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13728", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:42:24.971692Z", "version": "2.0.3"}}]}, "published": "2025-12-15T15:15:48.660", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3409232/fluent-security/tags/2.1.0/app/Hooks/Handlers/CustomAuthHandler.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a3187d3e-e1da-4af7-a1fa-9657389f9e22?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:05:35.843749+00:00", "value": {"mitigation_remediation": ["Update the FluentAuth plugin to version\u202f2.1.0\u202for newer, which removes the vulnerable shortcode handling.", "Delete or remove any posts, pages, widgets, or content that still contain the\u202ffluent_auth_reset_password\u202fshortcode, and cleanse any stored malicious attributes before installing the new plugin.", "Add a content\u2011security\u2011policy that disallows inline scripts or use a WordPress security plugin that blocks execution of unapproved JavaScript; alternatively, register a small snippet to unregister the shortcode globally after installing the update."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has TechJewel\u2019s FluentAuth \u2013 The Ultimate Authorization & Security Plugin installed and using a version up to and including\u202f2.0.3 is affected. The vulnerability requires the plugin\u2019s shortcode to be present in a post, page or widget and a user account with Contributor privilege or higher. Sites that have removed the shortcode or disabled it are not vulnerable.", "description_and_impact": "The FluentAuth plugin contains a stored cross\u2011site scripting flaw that allows an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript through the\u202ffluent_auth_reset_password\u202fshortcode. The plugin does not sanitize or escape user\u2011supplied attributes, enabling the stored payload to run on pages that include the shortcode. Based on the description, the attack vector is the insertion or editing of page content via the WordPress editor, which stores the malicious shortcode attributes in the database.", "risk_and_exploitability": "The CVSS score of\u202f6.4 places the severity at moderate. The EPSS score of\u202f<\u202f1\u202f% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA\u202fKEV catalog. However, because the required permissions are granted to many contributors and because the flaw allows arbitrary script execution, a site with an active contributor account is a feasible target. Attackers would create or edit content containing the vulnerable shortcode and supply malicious attributes that are stored and executed for all visitors of that content."}}}}, "created": "2025-12-16T20:45:35.655365+00:00", "updated": "2026-04-21T17:15:25.330354+00:00", "vendors": ["techjewel", "techjewel$PRODUCT$fluentauth", "wordpress", "wordpress$PRODUCT$wordpress"]}