What is the CVSS score of CVE-2025-13910?

CVE-2025-13910 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-13910?

Organizations using all should be aware of moderate risk from CVE-2025-13910, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2025-13910?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2025-13910

EUVD-2025-208914 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-66vw-3ggr-5vvg

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2025-208914

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the wwa_auth AJAX endpoint in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes logged by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin's log page, provided that the logging option is enabled in the plugin settings.

AnalysisAI

The WP-WebAuthn WordPress plugin contains an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the wwa_auth AJAX endpoint that allows attackers to inject arbitrary JavaScript into the plugin's log page. Affected are all versions up to and including 1.3.4 of the plugin (identified via CPE cpe:2.3:a:axton:wp-webauthn:*:*:*:*:*:*:*:*), which is exploitable only when logging is enabled in plugin settings. The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes, enabling persistent XSS execution whenever administrators or authorized users access the logging interface.

Technical ContextAI

The WP-WebAuthn plugin implements WebAuthn authentication for WordPress sites but fails to properly sanitize and escape user-controlled input in the wwa_auth AJAX handler. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS weakness where user-supplied data is stored in a database and later rendered in HTML without proper output encoding. The affected code paths are located in wwa-ajax.php (lines 906 and 982) where AJAX parameters are logged, and wwa-admin-content.php (line 319) where those logged attributes are displayed on the admin log page. Since the plugin uses WordPress's logging mechanism to store raw user input without sanitization, and subsequently renders this data without escaping functions like esc_html() or esc_attr(), an attacker can craft malicious AJAX requests containing script tags or event handlers that persist in the database and execute in the context of any administrator viewing the logs.

RemediationAI

Update the WP-WebAuthn plugin to version 1.3.5 or later, which should include fixes for input sanitization in the wwa_auth AJAX endpoint and proper output escaping in the admin log display pages. Until a patched version is available or deployed, WordPress administrators should immediately disable the logging feature in WP-WebAuthn plugin settings to prevent the storage and display of potentially malicious input. For organizations requiring logging functionality, restrict administrative log page access to a minimal set of trusted administrators via role-based access control, monitor AJAX requests to the wwa_auth endpoint for suspicious payloads, and consider implementing a Web Application Firewall (WAF) rule to block AJAX requests containing script tags or event handler attributes. Refer to the Wordfence vulnerability report (https://www.wordfence.com/threat-intel/vulnerabilities/id/44407fad-6ad4-4437-930f-b25a6c6203aa) for patch release notifications.