What is the CVSS score of CVE-2025-13840?

CVE-2025-13840 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-13840

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-12 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 19:39 vuln.today

CVE Published

Dec 12, 2025 - 04:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in BUKAZU Search widget plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript through the 'shortcode' parameter of the 'bukazu_search' shortcode. The vulnerability affects all versions up to and including 3.3.2 and results from insufficient input sanitization and output escaping. Malicious scripts execute in the context of any user accessing affected pages. EPSS score of 0.04% indicates low real-world exploitation probability despite moderate CVSS 6.4 severity.

Technical ContextAI

The vulnerability exists in the BUKAZU Search widget plugin's handling of the 'shortcode' parameter within the 'bukazu_search' shortcode implementation. The underlying issue (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from inadequate input sanitization and output escaping mechanisms for user-supplied shortcode attributes. WordPress shortcodes process user input that becomes embedded in page content; without proper escaping functions (such as esc_attr() or wp_kses_post()), user-controlled data flows directly into the DOM. The vulnerability is triggered when authenticated users with Contributor or Administrator privileges create or edit posts/pages containing the vulnerable shortcode with malicious payloads in the 'shortcode' parameter. The execution context is stored (database-persisted), making it a Stored XSS variant rather than Reflected XSS.

Affected ProductsAI

BUKAZU Search widget plugin for WordPress versions 3.3.2 and all earlier versions are affected. The plugin is available on the official WordPress plugin repository (wordpress.org/plugins/bukazu-search-widget/). Vulnerability affects any WordPress installation running this plugin at version 3.3.2 or below.

RemediationAI

Update the BUKAZU Search widget plugin to a version released after 3.3.2 that includes sanitization and escaping fixes. According to WordPress plugin repository changeset 3427947, upstream patches are available in the development trunk. Users should verify their plugin is updated to the latest available version via the WordPress admin dashboard (Plugins > Installed Plugins > Update if available). As an interim mitigation, administrators should restrict the Contributor role to trusted users only and audit existing posts/pages for suspicious shortcode usage. For additional guidance, refer to Wordfence's vulnerability disclosure (https://www.wordfence.com/threat-intel/vulnerabilities/id/a666d0e4-4fa7-4794-b270-afbccf5036c6?source=cve) and the WordPress plugin repository source code audit at https://plugins.trac.wordpress.org/changeset/3427947/.