Overview
A security vulnerability, identified as CVE-2025-13731, has been discovered in the Nexter Extension – Site Enhancements Toolkit plugin for WordPress. This vulnerability is a Stored Cross-Site Scripting (XSS) flaw, affecting versions up to and including 4.4.1. The vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious JavaScript code into website pages. This code executes whenever a user visits the compromised page, potentially leading to data theft, account takeover, or other malicious activities.
Technical Details
The vulnerability lies within the nxt-year shortcode functionality of the Nexter Extension plugin. Insufficient input sanitization and output escaping in the plugin’s code allows attackers to inject arbitrary web scripts through this shortcode. Specifically, the lack of proper validation for user-supplied input used by the shortcode allows malicious code to be stored in the database. When the affected page is rendered, this stored script is executed in the user’s browser.
The vulnerable code is located within the class-nexter-load-ext.php file.
CVSS Analysis
- CVE ID: CVE-2025-13731
- Severity: MEDIUM
- CVSS Score: 6.4
A CVSS score of 6.4 indicates a Medium severity vulnerability. This rating reflects the potential impact of the vulnerability, which could lead to unauthorized access and compromise of user accounts. The exploit requires authentication, limiting the scope of potential attackers, but the widespread use of WordPress and the ease of exploitation still make it a significant concern.
Possible Impact
Successful exploitation of this vulnerability could have several serious consequences:
- Account Takeover: Attackers could steal user session cookies and hijack administrator accounts.
- Data Theft: Sensitive information, such as login credentials or personal data, could be stolen.
- Malware Distribution: Attackers could inject malicious scripts to redirect users to phishing sites or distribute malware.
- Website Defacement: Attackers could modify website content, deface pages, or inject spam.
Mitigation and Patch Steps
The recommended course of action is to immediately update the Nexter Extension plugin to version 4.4.2 or later. This version contains a patch that addresses the input sanitization and output escaping issues, preventing the XSS vulnerability. To update, navigate to the Plugins section in your WordPress dashboard and update the Nexter Extension plugin.
If you cannot update immediately, consider temporarily disabling the plugin until you can apply the update. While this will remove the plugin’s functionality, it will also mitigate the risk of exploitation.
Also, as a general security practice, ensure all WordPress plugins and themes are regularly updated to the latest versions.
References
- CVE Details: CVE-2025-13731
- Vulnerable Code Location 1
- Vulnerable Code Location 2
- Patch Details
- Wordfence Threat Intelligence Report
