CVE-2025-13896: WordPress Social Feed Gallery XSS Flaw

CVE-2025-13896 Overview

CVE-2025-13896 is a Stored Cross-Site Scripting (XSS) vulnerability in the Social Feed Gallery Portfolio plugin for WordPress. The flaw affects all versions of the plugin up to and including 1.3. It resides in the id parameter of the [igp-wp] shortcode, where the plugin fails to properly sanitize input and escape output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, including administrators. The vulnerability is categorized under CWE-79.

Critical Impact
Authenticated Contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, account takeover, and administrative action forgery.

Affected Products

Social Feed Gallery Portfolio plugin for WordPress — versions up to and including 1.3
WordPress sites permitting Contributor-level (or higher) user registration
Any page or post embedding the [igp-wp] shortcode

Discovery Timeline

2025-12-06 - CVE-2025-13896 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13896

Vulnerability Analysis

The Social Feed Gallery Portfolio plugin registers the [igp-wp] shortcode to render portfolio galleries inside WordPress content. The shortcode accepts an id attribute that is echoed back into the page markup. The plugin does not apply sanitization functions such as sanitize_text_field() on input and does not escape the value on output with esc_attr() or esc_html(). As a result, attacker-controlled content in the id parameter is written directly into the rendered HTML.

Any authenticated user with permission to author posts, including the Contributor role, can embed the shortcode with a crafted id value. Once the content is saved, the malicious payload persists in the WordPress database. When a visitor renders the page, the browser parses and executes the injected script in the origin of the WordPress site.

Root Cause

The root cause is insufficient input sanitization and missing output escaping in the shortcode handler defined in class-portfolio-shortcode.php. Referenced code paths at lines 58 and 208 of the plugin source consume the id shortcode attribute without validating that it conforms to an expected format such as a numeric identifier.

Attack Vector

Exploitation requires an authenticated session with Contributor privileges or greater. The attacker creates or edits a post containing an [igp-wp id="..."] shortcode with a payload embedded in the id attribute. The payload persists in post content and executes each time the page is rendered. Because a Contributor can trigger review by an editor or administrator, the payload can execute in a privileged session and be used to perform actions such as creating administrator accounts or exfiltrating authentication cookies through the WordPress REST API.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Source for technical detail on the vulnerable handler.

Detection Methods for CVE-2025-13896

Indicators of Compromise

Post or page content containing the [igp-wp] shortcode with an id attribute that includes HTML tags, quotes, or JavaScript keywords such as onerror, onload, or <script.
New administrator accounts created shortly after a Contributor submitted or edited content that uses the plugin's shortcode.
Outbound requests from browsers viewing WordPress pages to unfamiliar third-party domains carrying session cookies or nonces.

Detection Strategies

Search the wp_posts table for shortcode occurrences with suspicious attribute values, for example SELECT ID, post_title FROM wp_posts WHERE post_content REGEXP 'igp-wp[^\]]*id="[^"]*<'.
Review the plugin's audit logs and WordPress user activity for content authored by Contributor-tier accounts referencing the [igp-wp] shortcode.
Inspect rendered HTML of pages using the shortcode for unexpected inline event handlers or <script> tags injected inside the portfolio container.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that inspects post content submissions for XSS payloads in shortcode attributes.
Alert on privilege changes and new administrator account creation events in the WordPress audit trail.
Monitor for anomalous JavaScript-initiated requests to /wp-json/wp/v2/users and /wp-admin/admin-ajax.php originating from administrator sessions.

How to Mitigate CVE-2025-13896

Immediate Actions Required

Update the Social Feed Gallery Portfolio plugin to a version later than 1.3 as soon as a fixed release is available from the vendor.
Restrict Contributor and Author role assignments to trusted users, and audit existing accounts with those roles.
Review all posts and pages that use the [igp-wp] shortcode and remove any entries containing script content in the id attribute.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.3 of the Social Feed Gallery Portfolio plugin. Consult the Wordfence advisory and the WordPress plugin repository for the current patched release. Apply the update through the WordPress admin dashboard or via WP-CLI using wp plugin update social-feed-gallery-portfolio.

Workarounds

Deactivate the Social Feed Gallery Portfolio plugin until a patched version is installed.
Remove or downgrade Contributor-level and higher permissions for untrusted users to prevent stored payload injection.
Deploy a WordPress-aware WAF rule that blocks shortcode attributes containing angle brackets, JavaScript event handlers, or javascript: URIs.
Enforce a strict Content Security Policy (CSP) header that disallows inline script execution on public pages.

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate social-feed-gallery-portfolio

# Audit posts referencing the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[igp-wp%' AND post_content REGEXP 'id=\"[^\"]*<';"