CVE-2025-13840
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Analysis
Stored Cross-Site Scripting in BUKAZU Search widget plugin for WordPress allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript through the 'shortcode' parameter of the 'bukazu_search' shortcode. The vulnerability affects all versions up to and including 3.3.2 and results from insufficient input sanitization and output escaping. Malicious scripts execute in the context of any user accessing affected pages. EPSS score of 0.04% indicates low real-world exploitation probability despite moderate CVSS 6.4 severity.
Technical Context
The vulnerability exists in the BUKAZU Search widget plugin's handling of the 'shortcode' parameter within the 'bukazu_search' shortcode implementation. The underlying issue (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from inadequate input sanitization and output escaping mechanisms for user-supplied shortcode attributes. WordPress shortcodes process user input that becomes embedded in page content; without proper escaping functions (such as esc_attr() or wp_kses_post()), user-controlled data flows directly into the DOM. The vulnerability is triggered when authenticated users with Contributor or Administrator privileges create or edit posts/pages containing the vulnerable shortcode with malicious payloads in the 'shortcode' parameter. The execution context is stored (database-persisted), making it a Stored XSS variant rather than Reflected XSS.
Affected Products
BUKAZU Search widget plugin for WordPress versions 3.3.2 and all earlier versions are affected. The plugin is available on the official WordPress plugin repository (wordpress.org/plugins/bukazu-search-widget/). Vulnerability affects any WordPress installation running this plugin at version 3.3.2 or below.
Remediation
Update the BUKAZU Search widget plugin to a version released after 3.3.2 that includes sanitization and escaping fixes. According to WordPress plugin repository changeset 3427947, upstream patches are available in the development trunk. Users should verify their plugin is updated to the latest available version via the WordPress admin dashboard (Plugins > Installed Plugins > Update if available). As an interim mitigation, administrators should restrict the Contributor role to trusted users only and audit existing posts/pages for suspicious shortcode usage. For additional guidance, refer to Wordfence's vulnerability disclosure (https://www.wordfence.com/threat-intel/vulnerabilities/id/a666d0e4-4fa7-4794-b270-afbccf5036c6?source=cve) and the WordPress plugin repository source code audit at https://plugins.trac.wordpress.org/changeset/3427947/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today