CVE-2025-13626: myLCO WordPress Plugin XSS Vulnerability

CVE-2025-13626 Overview

CVE-2025-13626 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the myLCO plugin for WordPress in all versions up to and including 0.8.1. The flaw stems from insufficient input sanitization and output escaping around the $_SERVER['PHP_SELF'] parameter in myLCO.php. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim is tricked into clicking a crafted link. Successful exploitation can lead to session compromise, redirection to attacker-controlled sites, and unauthorized actions performed in the context of the targeted user.

Critical Impact

Unauthenticated attackers can inject arbitrary JavaScript that executes in a victim's browser, enabling session theft and account takeover on affected WordPress sites when the victim clicks a malicious link.

Affected Products

• myLCO plugin for WordPress — all versions up to and including 0.8.1
• WordPress sites running the vulnerable plugin file myLCO.php
• Any WordPress deployment where the plugin is active on public-facing pages

Discovery Timeline

• 2025-12-06 - CVE-2025-13626 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13626

Vulnerability Analysis

The vulnerability is a Reflected XSS issue in the myLCO WordPress plugin. The plugin reads the $_SERVER['PHP_SELF'] value and reflects it into HTML output without applying adequate sanitization or contextual escaping. Because $_SERVER['PHP_SELF'] can be manipulated by appending crafted path segments to the request URI, attackers can inject HTML and JavaScript into the response body.

The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, typically clicking a specifically crafted URL. The scope is changed, meaning the injected script executes with access to resources beyond the vulnerable component, which increases the potential impact on the browsing session.

Root Cause

The root cause is the direct use of $_SERVER['PHP_SELF'] in generated output at myLCO.php#L438 without passing the value through a sanitization function such as esc_url(), esc_attr(), or htmlspecialchars(). WordPress developers are expected to treat $_SERVER['PHP_SELF'] as untrusted input because PHP populates it directly from the request URI, which attackers control.

Attack Vector

An unauthenticated attacker crafts a URL targeting a page served by the vulnerable plugin. The URL appends a malicious payload after the script name, for example /wp-content/plugins/mylco/myLCO.php/"><script>...</script>. When the victim clicks the link, the plugin echoes the manipulated PHP_SELF value into the response, and the browser executes the injected script in the context of the WordPress site's origin.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable line.

Detection Methods for CVE-2025-13626

Indicators of Compromise

• Web server access logs showing requests to myLCO.php with unusual path suffixes containing characters such as <, >, ", or %3C, %3E, %22.
• HTTP referrers containing script tags, javascript: URIs, or event handler attributes like onerror= and onload=.
• Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting the WordPress site.

Detection Strategies

• Deploy a Web Application Firewall (WAF) rule that inspects request URIs targeting myLCO.php and blocks payloads containing HTML control characters or script keywords.
• Correlate WordPress access logs with browser-side error reports and Content Security Policy (CSP) violation reports to surface reflected injection attempts.
• Scan installed WordPress plugins across the estate to inventory sites running myLCO version 0.8.1 or earlier.

Monitoring Recommendations

• Alert on HTTP 200 responses to requests where the URI path contains encoded angle brackets or quote characters.
• Monitor for spikes in referrer traffic from URL shorteners or newly registered domains linking to plugin endpoints.
• Track authenticated administrator sessions for anomalous actions immediately following a click-through from an external link.

How to Mitigate CVE-2025-13626

Immediate Actions Required

• Deactivate the myLCO plugin on any WordPress site running version 0.8.1 or earlier until a patched release is available.
• Apply a WAF virtual patch that blocks requests to myLCO.php containing HTML metacharacters in the URI path.
• Audit administrator and editor accounts for unauthorized changes and rotate session cookies and passwords if suspicious activity is found.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Administrators should monitor the WordPress Plugin Overview page and the Wordfence Vulnerability Report for release announcements and upgrade to the fixed version as soon as it is available.

Workarounds

• Remove or disable the myLCO plugin until a security update is released.
• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
• Educate administrators and editors to avoid clicking untrusted links to the site while authenticated with privileged accounts.

# Example CSP header to reduce reflected XSS impact
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"