CVE-2025-13513 Overview
CVE-2025-13513 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Clik Stats plugin for WordPress. The flaw exists in all plugin versions up to and including 0.8. Attackers can abuse the $_SERVER['PHP_SELF'] parameter due to insufficient input sanitization and output escaping in ck_admin.php. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation enables session hijacking, credential theft, or redirection of authenticated WordPress administrators through crafted URLs.
Affected Products
- Clik Stats plugin for WordPress, all versions through 0.8
- WordPress installations with the clikstats plugin active
- Administrative pages served by ck_admin.php
Discovery Timeline
- 2025-12-04 - CVE-2025-13513 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13513
Vulnerability Analysis
The Clik Stats plugin renders the value of the PHP superglobal $_SERVER['PHP_SELF'] back to the browser without sanitization or output escaping. The unsafe usage occurs in ck_admin.php at line 47, which handles administrative rendering. Because $_SERVER['PHP_SELF'] reflects the requested URI path, attackers can append arbitrary script payloads that PHP includes in the response. The reflected output then executes in the victim's browser under the origin of the WordPress site. This behavior enables client-side script injection without any authentication.
Root Cause
The root cause is direct emission of $_SERVER['PHP_SELF'] to HTML output without applying esc_url(), esc_attr(), or htmlspecialchars(). WordPress developers must treat all $_SERVER values as attacker-controlled input. The plugin author did not neutralize special characters such as <, >, and " before writing them into a form action attribute.
Attack Vector
Exploitation requires user interaction. An attacker crafts a URL that appends an encoded script payload to the plugin's admin script path. The victim, typically a logged-in WordPress administrator, must click the malicious link. When the browser renders the response, the injected script executes with the victim's session context. This can be leveraged to exfiltrate wp-admin cookies, create rogue administrator accounts, or plant persistent backdoors through the REST API.
No verified public exploit code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for technical details.
Detection Methods for CVE-2025-13513
Indicators of Compromise
- Requests to /wp-content/plugins/clikstats/ck_admin.php containing URL-encoded <script>, onerror=, or javascript: payloads in the path
- Referer headers showing external origins leading to WordPress admin endpoints
- Unexpected creation of administrator accounts or modifications to wp_users following admin page access
Detection Strategies
- Inspect web server access logs for path traversal artifacts and encoded HTML tags targeting ck_admin.php
- Deploy Web Application Firewall (WAF) rules that block reflected XSS patterns in URI paths targeting WordPress plugin directories
- Correlate anomalous admin session activity with prior requests containing suspicious PHP_SELF values
Monitoring Recommendations
- Alert on WordPress admin logins immediately preceded by external referrers to ck_admin.php
- Monitor for outbound network connections from browsers hosting active wp-admin sessions
- Track file integrity of core WordPress files and plugin directories for unauthorized modifications
How to Mitigate CVE-2025-13513
Immediate Actions Required
- Deactivate and remove the Clik Stats plugin from all WordPress installations until a patched version is published
- Force logout of all administrative sessions and rotate credentials for any user who accessed the plugin admin page
- Audit wp_users and wp_usermeta tables for unauthorized administrator accounts
Patch Information
No fixed version has been published in the WordPress plugin repository. The Clik Stats plugin remains vulnerable in all versions through 0.8. Site owners should assume no vendor patch is forthcoming and remove the plugin. Refer to the Wordfence Vulnerability Report for updates.
Workarounds
- Block external access to /wp-content/plugins/clikstats/ at the reverse proxy or WAF layer
- Restrict wp-admin access by IP allowlist to reduce exposure of authenticated administrators to reflected XSS lures
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts on WordPress admin pages
# Nginx rule to block access to the vulnerable plugin path
location ~* /wp-content/plugins/clikstats/ {
deny all;
return 403;
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
