CVE-2025-13848: STM Gallery WordPress Plugin XSS Flaw

CVE-2025-13848 Overview

CVE-2025-13848 is a Stored Cross-Site Scripting (XSS) vulnerability in the STM Gallery plugin for WordPress, affecting all versions up to and including 0.9. The flaw resides in the composicion parameter, which lacks sufficient input sanitization and output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The vulnerability is classified under CWE-79 and stems from improper neutralization of input during web page generation.

Critical Impact
Authenticated contributors can persist arbitrary scripts that execute against site administrators and visitors, enabling session theft, content defacement, and unauthorized administrative actions.

Affected Products

STM Gallery plugin for WordPress, versions up to and including 0.9
WordPress sites running STM Gallery 1.9 branch as referenced in the advisory
Any WordPress installation permitting Contributor-level accounts on a vulnerable plugin version

Discovery Timeline

2026-01-07 - CVE-2025-13848 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13848

Vulnerability Analysis

The STM Gallery plugin accepts user-supplied content through the composicion parameter without applying adequate sanitization routines such as wp_kses or escaping helpers like esc_attr and esc_html on output. As a result, any HTML or JavaScript supplied through this parameter is stored in the WordPress database and rendered verbatim when the affected page is requested. The vulnerable code path is visible in stmgallery_v.0.9.php at line 121, as referenced by the WordPress Plugin Source Code.

The scope change in the impact reflects that injected scripts execute in the security context of the WordPress site rather than the plugin. This enables an attacker to act on behalf of any authenticated user who views the page, including administrators. The Wordfence Vulnerability Report documents the technical specifics of the issue.

Root Cause

The root cause is missing input validation and output encoding on the composicion parameter. WordPress provides server-side functions to neutralize HTML and script content before persistence and rendering, but the plugin does not invoke them on this parameter. Attacker-controlled markup is concatenated directly into page output.

Attack Vector

An attacker first obtains Contributor-level credentials or higher on the target WordPress site. The attacker then submits a gallery item containing JavaScript inside the composicion field. The malicious payload is stored in the database and is delivered to every user who subsequently loads the affected page. Because the attack vector is network-based and requires only low privileges with no user interaction, exploitation can be automated through standard HTTP requests.

No public proof-of-concept code or exploit module is currently linked from NVD for this CVE. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-13848

Indicators of Compromise

Gallery records containing <script>, onerror=, onload=, or javascript: constructs stored against the composicion parameter
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting gallery pages
New or modified WordPress administrator accounts created without a corresponding audit trail
HTTP POST requests from Contributor accounts targeting STM Gallery editing endpoints with HTML-encoded script payloads

Detection Strategies

Inspect the wp_posts and plugin-specific tables for stored values in the composicion field that contain HTML tags or event handler attributes
Review WordPress access logs for POST requests to STM Gallery endpoints originating from Contributor or Author accounts
Monitor browser-side Content Security Policy violation reports for inline script execution on pages rendering STM Gallery content

Monitoring Recommendations

Enable WordPress audit logging to record content changes by Contributor-level and Author-level users
Forward web server and WordPress application logs to a central SIEM for correlation against known XSS payload patterns
Alert on creation or modification of administrator accounts following recent edits to gallery content

How to Mitigate CVE-2025-13848

Immediate Actions Required

Deactivate the STM Gallery plugin until a patched release is installed, particularly on sites that allow Contributor-level registration
Audit existing gallery entries for stored script content and remove any malicious payloads from the database
Review WordPress user accounts and revoke unnecessary Contributor or Author privileges
Rotate administrator credentials and invalidate active sessions if injected scripts may have executed against an administrator

Patch Information

At the time of NVD publication, no fixed version of the STM Gallery plugin is referenced. Monitor the WordPress Plugin Development Version repository and the Wordfence Vulnerability Report for an updated release that applies wp_kses_post or equivalent sanitization to the composicion parameter.

Workarounds

Restrict the Contributor and Author roles to trusted users only and require multi-factor authentication for all content editors
Deploy a web application firewall rule that blocks HTTP requests containing script tags or event handler attributes in the composicion parameter
Apply a strict Content Security Policy that disallows inline scripts on pages rendering STM Gallery content
Replace STM Gallery with an actively maintained gallery plugin until a vendor patch is released

bash

# Example WAF rule (ModSecurity) blocking script payloads in the composicion parameter
SecRule ARGS:composicion "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1013848,phase:2,deny,status:403,log,\
    msg:'CVE-2025-13848 STM Gallery composicion XSS attempt blocked'"