CVE-2025-13627 – The Makesweat WordPress plugin has a stored XSS... (How to Fix)

📋 TL;DR

The Makesweat WordPress plugin has a stored XSS vulnerability in the 'makesweat_clubid' setting that allows authenticated administrators to inject malicious scripts. These scripts execute whenever users access compromised pages, potentially affecting all visitors to vulnerable WordPress sites.

💻 Affected Systems

Products:

Makesweat WordPress Plugin

Versions: All versions up to and including 0.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress administrator or higher privileges to exploit. All WordPress installations using vulnerable plugin versions are affected.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator account compromise leads to site takeover, credential theft from all visitors, or malware distribution through the compromised WordPress site.

🟠

Likely Case

Attackers with admin access inject scripts to steal session cookies, redirect users to malicious sites, or deface website content.

🟢

If Mitigated

With proper access controls and input validation, impact is limited to administrators who might accidentally execute scripts in their own sessions.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires administrator credentials but is technically simple once access is obtained. The vulnerability is in core plugin functionality.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: https://it.wordpress.org/plugins/makesweat/

Restart Required: No

Instructions:

1. Remove the Makesweat plugin from WordPress
2. Delete plugin files from /wp-content/plugins/makesweat/
3. Check for any injected scripts in database
4. Consider alternative plugins with active maintenance

🔧 Temporary Workarounds

Disable Makesweat Plugin

all

Deactivate and remove the vulnerable plugin from WordPress

wp plugin deactivate makesweat
wp plugin delete makesweat

Restrict Admin Access

all

Implement strict access controls and monitoring for administrator accounts

🧯 If You Can't Patch

Implement web application firewall with XSS protection rules
Enable Content Security Policy headers to restrict script execution

🔍 How to Verify

Check if Vulnerable:

Check WordPress plugins list for Makesweat version 0.1 or earlier

Check Version:

wp plugin list --name=makesweat --field=version

Verify Fix Applied:

Confirm Makesweat plugin is not installed or is removed from /wp-content/plugins/

📡 Detection & Monitoring

Log Indicators:

Unusual administrator activity modifying plugin settings
Multiple requests to makesweat_clubid parameter with script-like content

Network Indicators:

Script tags in makesweat_clubid parameter values
Unusual outbound connections from WordPress admin pages

SIEM Query:

source="wordpress" AND (uri="*makesweat_clubid*" AND data="*script*" OR data="*javascript:*")

📊 Metadata

CVE ID: CVE-2025-13627

CVSS v3 Score: 4.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.04% exploit probability (13.2th percentile)

Published: January 14, 2026

Last Updated: January 14, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13627, you might also want to check these: