CVE-2025-13678: Thai Lottery Widget XSS Vulnerability

CVE-2025-13678 Overview

CVE-2025-13678 is a Stored Cross-Site Scripting (XSS) vulnerability in the Thai Lottery Widget plugin for WordPress. The flaw affects all plugin versions up to and including 2.5. It stems from insufficient input sanitization and output escaping on the width and height attributes of the thailottery shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and content manipulation.

Affected Products

Thai Lottery Widget plugin for WordPress, versions ≤ 2.5
WordPress sites permitting Contributor-level registration or self-registration
WordPress pages and posts rendering the thailottery shortcode

Discovery Timeline

2025-12-05 - CVE-2025-13678 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13678

Vulnerability Analysis

The Thai Lottery Widget plugin registers a thailottery shortcode that accepts width and height attributes to size rendered lottery output. The plugin passes these attributes directly into HTML markup without sanitization or context-aware output escaping. An authenticated attacker embeds shortcode attribute values that break out of the intended HTML attribute context and inject <script> tags or event handlers. The payload is stored in the post or page content and executes each time a visitor loads the page. Because WordPress Contributors can submit posts containing shortcodes, the barrier to exploitation is low on sites that permit contributor accounts.

Root Cause

The shortcode handler in thailottery.php (see the WordPress plugin source) concatenates user-supplied width and height values into the HTML output. The code does not apply esc_attr(), absint(), or equivalent WordPress sanitization helpers before rendering. This missing output escaping is the direct cause of the stored XSS.

Attack Vector

Exploitation requires network access to a vulnerable WordPress site and an authenticated account with Contributor privileges or higher. The attacker authors a post containing the thailottery shortcode with a crafted width or height value that includes a quote-escape sequence followed by an event handler or <script> element. Once the post is published or previewed by a higher-privileged user, the payload executes in the reviewer's browser session. See the Wordfence vulnerability analysis for additional technical context.

Detection Methods for CVE-2025-13678

Indicators of Compromise

Post or page content containing thailottery shortcode invocations with unusual width or height values that include quote characters, angle brackets, or on* event handler names
Unexpected <script> tags, javascript: URIs, or event handler attributes appearing in rendered pages that use the plugin
New administrator or editor accounts created shortly after a Contributor account submitted content containing the shortcode
Outbound requests from visiting browsers to attacker-controlled domains referenced in stored payloads

Detection Strategies

Audit the wp_posts table for shortcode instances of [thailottery ...] and inspect attribute values for HTML metacharacters
Deploy a web application firewall rule that flags shortcode attributes containing <, >, ", ', or on\w+= patterns
Enable Content Security Policy (CSP) reporting to surface inline script execution originating from post content

Monitoring Recommendations

Monitor creation and modification of posts by Contributor-level users, particularly submissions containing shortcodes
Alert on privilege escalation events and unexpected changes to administrator accounts
Review WordPress access logs for authenticated POST requests to wp-admin/post.php that include shortcode payloads with suspicious characters

How to Mitigate CVE-2025-13678

Immediate Actions Required

Deactivate the Thai Lottery Widget plugin until a patched version is available and installed
Audit all Contributor, Author, and Editor accounts and remove any that are unrecognized or unnecessary
Search existing posts and pages for the thailottery shortcode and review attribute values for malicious content
Rotate credentials and session tokens for administrator accounts that may have loaded a compromised page

Patch Information

At the time of the NVD entry (last modified 2026-06-17), no vendor-patched version above 2.5 is referenced in the advisory. Monitor the WordPress plugin repository and the Wordfence advisory for updated release information and apply any published fix that adds esc_attr() or numeric casting to the width and height attributes.

Workarounds

Restrict shortcode usage by removing the thailottery shortcode registration or replacing the plugin with an alternative
Downgrade Contributor-level accounts or disable open user registration until a patch is applied
Deploy a WAF ruleset that blocks requests containing the thailottery shortcode with non-numeric width or height values
Implement a strict Content Security Policy that disallows inline script execution on pages that render plugin output

bash

# Configuration example: locate and audit shortcode usage across a WordPress database
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[thailottery%' AND post_status IN ('publish','draft','pending');"

# Temporarily disable the vulnerable plugin from the CLI
wp plugin deactivate thai-lottery-widget