CVE-2025-13525: WP Directory Kit XSS Vulnerability

CVE-2025-13525 Overview

CVE-2025-13525 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the WP Directory Kit plugin for WordPress. The flaw exists in all versions up to and including 1.4.5. The plugin fails to properly sanitize input and escape output on the order_by parameter, allowing unauthenticated attackers to inject arbitrary JavaScript into rendered pages. Successful exploitation requires user interaction, such as clicking a crafted link. Once triggered, the injected script executes in the victim's browser session in the context of the affected WordPress site.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the victim's browser, enabling session theft, credential harvesting, and administrative account takeover when a logged-in administrator is targeted.

Affected Products

WP Directory Kit plugin for WordPress, versions up to and including 1.4.5
WordPress sites running the wpdirectorykit plugin
Any site rendering the wdk_messages/index.php view with the vulnerable parameter

Discovery Timeline

2025-11-27 - CVE-2025-13525 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13525

Vulnerability Analysis

The vulnerability resides in the WP Directory Kit plugin's message view template, specifically application/views/wdk_messages/index.php at lines 38-39. The order_by HTTP request parameter is reflected into the rendered HTML response without adequate sanitization or output escaping. An attacker crafts a URL containing malicious JavaScript in the order_by parameter and delivers it through phishing or social engineering. When the victim visits the crafted URL, the payload executes in their browser under the site's origin.

Because the vulnerability is unauthenticated, any visitor who clicks a malicious link is exposed. The scope changes to the browser's DOM context, allowing the attacker to access cookies, local storage, and any authenticated session belonging to the current user. Targeting a WordPress administrator can escalate the impact to full site compromise through admin actions performed via the injected script.

Root Cause

The root cause is insufficient input validation and missing output escaping when the order_by query parameter is written into the page markup. WordPress provides helpers such as esc_attr(), esc_html(), and sanitize_key() that neutralize untrusted input, but the vulnerable code path does not apply them before echoing the parameter value.

Attack Vector

Exploitation requires network access to the target WordPress site and user interaction. The attacker sends the victim a link where the order_by query string parameter contains a JavaScript payload, for example a <script> tag or an event handler in an HTML attribute. When the browser renders the response, the payload executes. No authentication or elevated privileges are required from the attacker.

See the Wordfence Vulnerability Report and the WordPress Directory Kit source file for technical details on the vulnerable code paths.

Detection Methods for CVE-2025-13525

Indicators of Compromise

Web server access logs containing requests to WP Directory Kit endpoints with order_by values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E
Referer headers pointing to attacker-controlled domains preceding requests to plugin URLs
Outbound browser requests to unfamiliar hosts immediately after a user visits a WP Directory Kit page

Detection Strategies

Inspect HTTP query strings for HTML tags, JavaScript event handlers, or encoded payloads targeting the order_by parameter
Deploy a Web Application Firewall (WAF) rule that blocks reflected XSS patterns on WordPress endpoints associated with wpdirectorykit
Enforce a strict Content Security Policy (CSP) and monitor report-uri or report-to endpoints for script-src violations originating from plugin pages

Monitoring Recommendations

Alert on unusual URL parameter lengths or high-entropy values submitted to WP Directory Kit routes
Correlate administrator session activity with prior clicks on external links to detect targeted phishing chains
Review the plugin's version inventory across all managed WordPress sites and flag installations at 1.4.5 or earlier

How to Mitigate CVE-2025-13525

Immediate Actions Required

Update the WP Directory Kit plugin to a version newer than 1.4.5 as soon as the vendor publishes a fixed release
Audit WordPress administrator accounts for unauthorized changes, new users, and unexpected plugin or theme modifications
Rotate WordPress administrator credentials and invalidate active sessions if an administrator may have clicked a suspicious link

Patch Information

The vendor tracks fixes in the plugin's Subversion repository. Review the WordPress Directory Kit changeset and the official WP Directory Kit plugin page for the latest release information. Apply the update through the WordPress admin dashboard or via WP-CLI using wp plugin update wpdirectorykit.

Workarounds

Deactivate the WP Directory Kit plugin until a patched release is available and installed
Deploy WAF rules that reject requests containing <, >, or javascript: in the order_by query parameter
Restrict access to WP Directory Kit pages behind authentication or IP allowlists where feasible
Enable a restrictive Content Security Policy that disallows inline scripts on WordPress front-end pages

bash

# Example ModSecurity rule to block reflected XSS on the order_by parameter
SecRule ARGS:order_by "@rx (?i)(<script|javascript:|onerror=|onload=|%3Cscript)" \
    "id:1013525,phase:2,deny,status:403,log,msg:'CVE-2025-13525 WP Directory Kit XSS attempt'"