CVE-2025-13367

Description

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Details

CVSS Score

6.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

User Registration & Membership插件 < 4.4.7

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

攻击者通过WordPress编辑器插入包含恶意脚本的shortcode，如[user_registration_form id='1'><script>alert(document.cookie)</script>']，该代码被保存并在后续访问时执行。

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13367
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13367
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13367/
[4] VulDB https://vuldb.com/cve/CVE-2025-13367
[5] https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php
[6] https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php
[7] https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13367", "sourceIdentifier": "[email protected]", "published": "2025-12-15T15:15:48.187", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcode attributes in all versions up to, and including, 4.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/membership-listing.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3412096/user-registration/trunk/modules/membership/includes/Templates/thank-you-page.php", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2244945a-5b3a-463d-9910-46a6f7afaf6c?source=cve", "source": "[email protected]"}]}}