CVE-2025-13969 – The Reviews Sorted WordPress plugin has a store... (How to Fix)

Q: What is the severity of CVE-2025-13969?

CVE-2025-13969 has a CVSS score of 6.4 (MEDIUM). The Reviews Sorted WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 2.4.2 are affected.

📋 TL;DR

The Reviews Sorted WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users visit the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 2.4.2 are affected.

💻 Affected Systems

Products:

WordPress Reviews Sorted plugin

Versions: All versions up to and including 2.4.2

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the Reviews Sorted plugin enabled. Contributor-level access or higher is needed for exploitation.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts that steal user session cookies or credentials, leading to account takeover and potential privilege escalation.

🟢

If Mitigated

With proper user role management and input validation, impact is limited to defacement or minor data leakage from users visiting compromised pages.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once an attacker has contributor privileges. The vulnerability is in publicly accessible code.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.4.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/reviews-sorted

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Reviews Sorted' and check for updates. 4. If update is available, click 'Update Now'. 5. Alternatively, download latest version from WordPress plugin repository and replace existing files.

🔧 Temporary Workarounds

Remove Contributor Access

all

Temporarily remove contributor-level access for untrusted users until patch is applied.

Disable Plugin

all

Deactivate the Reviews Sorted plugin if not essential for site functionality.

🧯 If You Can't Patch

Implement strict user role management and audit contributor-level accounts
Add web application firewall rules to block XSS payloads in the 'space' parameter

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for Reviews Sorted version. If version is 2.4.2 or earlier, you are vulnerable.

Check Version:

wp plugin list --name=reviews-sorted --field=version

Verify Fix Applied:

After updating, verify plugin version is 2.4.3 or later in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to pages containing [reviews-slider] shortcode with 'space' parameter containing script tags
Multiple failed login attempts followed by successful contributor login

Network Indicators:

Outbound connections to suspicious domains from your WordPress site
Unexpected JavaScript execution in page responses

SIEM Query:

source="wordpress.log" AND ("[reviews-slider]" AND "space=" AND ("<script" OR "javascript:"))

📊 Metadata

CVE ID: CVE-2025-13969

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.07% exploit probability (22th percentile)

Published: December 12, 2025

Last Updated: December 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13969, you might also want to check these: