CVE-2025-13623: Twitscription WordPress Plugin XSS Flaw

CVE-2025-13623 Overview

CVE-2025-13623 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Twitscription plugin for WordPress. The flaw affects all versions up to and including 0.1.1. It resides in the handling of the PATH_INFO value passed through admin.php, where the plugin fails to sanitize input or escape output before reflecting it into an administrative page.

Unauthenticated attackers can craft malicious URLs that inject arbitrary JavaScript into a page. Successful exploitation requires user interaction, typically a victim clicking a specially crafted link. The injected script executes in the victim's browser context and can be used to hijack sessions or trigger privileged actions.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, administrative action abuse, and further site compromise when an authenticated user is tricked into clicking a malicious link.

Affected Products

Twitscription plugin for WordPress, versions 0.0 through 0.1.1 (inclusive)
WordPress installations with Twitscription active and reachable at admin.php
Sites where administrators or editors browse untrusted links while authenticated

Discovery Timeline

2025-12-05 - CVE-2025-13623 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13623

Vulnerability Analysis

The Twitscription plugin registers a handler that reads the PATH_INFO component of the incoming request to admin.php. The plugin echoes this value back into the rendered HTML response without applying sanitization such as sanitize_text_field() or output escaping through esc_html() or esc_attr().

Because PATH_INFO is fully attacker-controlled and reflected into the response, an attacker can embed HTML and JavaScript payloads directly in the URL path. When a browser renders the response, the injected script executes in the origin of the vulnerable WordPress site. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

The scope change reflects the ability of the injected script to affect resources beyond the vulnerable component, including authenticated administrator sessions and CSRF-protected endpoints. See the Wordfence Vulnerability Report for additional analysis.

Root Cause

The root cause is insufficient input sanitization and missing output escaping on the PATH_INFO value processed by admin.php. The relevant sink is referenced in the plugin source at line 101 of twitscription.php, as shown in the WordPress Plugin Code Reference. No contextual encoding is applied before the value is inserted into HTML output.

Attack Vector

Exploitation occurs over the network and requires no authentication. The attacker crafts a URL to the vulnerable WordPress site that appends a JavaScript payload to the admin.php path segment. The attacker then delivers this URL through phishing, forum posts, or malicious advertisements. When a logged-in user, especially an administrator, clicks the link, the payload executes in their browser session and can perform actions on the site using their credentials.

The vulnerability manifests when PATH_INFO is read and directly concatenated into an HTML response. Refer to the WordPress Plugin Development Main source for the exact reflection point. No proof-of-concept code is published in the CVE record.

Detection Methods for CVE-2025-13623

Indicators of Compromise

Web server access logs showing requests to admin.php with HTML entities, angle brackets, or script tokens in the PATH_INFO segment
Referer headers from external domains preceding requests to admin.php/<payload> paths
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the WordPress site

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that blocks or alerts on requests to admin.php containing script tags, event handler attributes, or JavaScript URI schemes in the URL path
Review WordPress activity logs for administrative changes originating from unusual IP addresses or occurring immediately after a click event
Correlate reflected-payload signatures across access logs and endpoint browser telemetry to identify successful XSS delivery

Monitoring Recommendations

Enable verbose HTTP logging that includes full request paths and Referer headers for the WordPress admin surface
Monitor administrator accounts for anomalous plugin, user, or theme modifications following link-click activity
Alert on browser-side execution of external scripts loaded from non-approved origins on WordPress admin pages

How to Mitigate CVE-2025-13623

Immediate Actions Required

Deactivate and remove the Twitscription plugin on all WordPress sites running version 0.1.1 or earlier
Force a password reset and terminate active sessions for all administrator and editor accounts on affected sites
Apply WAF rules that block requests containing script payloads in the admin.phpPATH_INFO segment until the plugin is removed

Patch Information

No patched version of the Twitscription plugin has been published at the time of this writing. The WordPress Twitscription Plugin Page lists 0.1.1 as the current release. Administrators should treat the plugin as end-of-life and replace it with a maintained alternative that provides comparable functionality.

Workarounds

Remove the Twitscription plugin directory from wp-content/plugins/ if immediate uninstallation through the WordPress dashboard is not possible
Restrict access to admin.php at the web server or WAF layer to trusted source IP addresses
Enforce a strict Content Security Policy (CSP) that disallows inline script execution and restricts script sources to trusted origins
Train administrative users to avoid clicking untrusted links while authenticated to WordPress

bash

# Example nginx rule to block script-like payloads in admin.php path
location ~ ^/admin\.php {
    if ($request_uri ~* "(<|%3C)\s*script|javascript:|onerror=|onload=") {
        return 403;
    }
}