CVE-2025-13667: WP Recipe Manager XSS Vulnerability

CVE-2025-13667 Overview

CVE-2025-13667 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the WP Recipe Manager plugin for WordPress in all versions up to and including 1.0.0. The flaw exists in the Skill Level input field, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or above to inject arbitrary JavaScript. Injected scripts execute in the browser of any user visiting an affected page. The vulnerable code path resides in inc/libs/class.metaboxes.php at line 203.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser context of administrators and site visitors, enabling session theft, account takeover, and arbitrary administrative actions.

Affected Products

WP Recipe Manager plugin for WordPress, versions up to and including 1.0.0
WordPress sites permitting Contributor-level account registration
WordPress installations exposing recipe creation workflows to untrusted authors

Discovery Timeline

2026-01-07 - CVE-2025-13667 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13667

Vulnerability Analysis

The vulnerability resides in the recipe metabox handler in inc/libs/class.metaboxes.php. When a contributor creates or edits a recipe, the Skill Level attribute is accepted from the request and persisted to the database without sanitization. The same value is later rendered back into post pages without output escaping. The result is a stored XSS sink: an attacker writes a payload once and triggers execution every time the affected page is rendered.

Because the attack only requires Contributor-level privileges, any site that accepts guest authors, recipe submissions, or community contributions is exposed. The CVSS scope flag S:C reflects that injected scripts execute outside the plugin's trust boundary, affecting administrative users who view contributor submissions during moderation.

Root Cause

The root cause is the absence of two WordPress security primitives. On input, the plugin does not call sanitize_text_field() or a comparable sanitizer against the Skill Level attribute. On output, the stored value is echoed without esc_attr() or esc_html(). This dual failure converts a benign metadata field into a persistent script injection point.

Attack Vector

An authenticated attacker with the contributor role or higher navigates to the recipe editor and supplies a JavaScript payload in the Skill Level field. The payload is saved to post meta and rendered into pages that display recipe attributes. Any administrator previewing the recipe for moderation, or any visitor browsing the published recipe, executes the payload in their authenticated session.

Exploitation does not require user interaction beyond viewing the page. Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source Code for the vulnerable code path.

Detection Methods for CVE-2025-13667

Indicators of Compromise

Recipe post meta entries containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the Skill Level field.
Unexpected outbound requests from administrator browsers to attacker-controlled domains following recipe page access.
New administrator or editor accounts created shortly after recipe edits by contributor accounts.
WordPress audit log entries showing contributor-level edits to recipe metadata immediately preceding privilege changes.

Detection Strategies

Query the wp_postmeta table for recipe entries where the Skill Level value contains angle brackets or JavaScript event handlers.
Monitor WordPress access logs for POST requests to /wp-admin/post.php from contributor accounts editing recipe post types.
Inspect rendered recipe pages with a headless browser to identify scripts loaded from non-allowlisted origins.

Monitoring Recommendations

Enable WordPress audit logging for post meta changes on the recipe post type.
Forward web server access logs to a SIEM and alert on contributor-role edits followed by administrator page views.
Apply a Content Security Policy that blocks inline scripts on the WordPress front end to surface injection attempts in browser console reports.

How to Mitigate CVE-2025-13667

Immediate Actions Required

Update the WP Recipe Manager plugin to a version newer than 1.0.0 once the vendor releases a fix.
Audit existing recipe content for stored payloads in the Skill Level field and purge malicious entries.
Restrict Contributor-level access to trusted users until a patched version is available.
Force password resets for administrators who viewed contributor-submitted recipes during the exposure window.

Patch Information

At the time of publication, no fixed version is identified in the NVD record. Track the Wordfence Vulnerability Report and the plugin repository for an updated release. Until a patched build ships, treat the plugin as vulnerable on every installation.

Workarounds

Deactivate the WP Recipe Manager plugin on sites that accept contributor submissions.
Deploy a web application firewall rule that blocks recipe submissions containing <script>, on*= event handlers, or javascript: URIs.
Enforce a strict Content Security Policy disallowing inline scripts and unknown external script sources.
Remove the Contributor role from accounts that do not require recipe authoring.

bash

# Example wp-cli command to identify suspicious Skill Level meta values
wp db query "SELECT post_id, meta_value FROM wp_postmeta \
  WHERE meta_key LIKE '%skill_level%' \
  AND (meta_value LIKE '%<%' OR meta_value LIKE '%javascript:%');"