CVE-2025-13899: WordPress TR Timthumb XSS Vulnerability

CVE-2025-13899 Overview

The TR Timthumb plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 1.0.4. The flaw exists in the plugin's shortcode attribute handling, where user-supplied input is neither sanitized on entry nor escaped on output. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of any visitors who view the affected page. The issue is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist malicious scripts into published pages, enabling session hijacking, credential theft, and administrative account takeover through victim browsers.

Affected Products

WordPress TR Timthumb plugin versions 1.0.0 through 1.0.4
WordPress sites permitting Contributor-level accounts or higher
Any deployment rendering pages containing the vulnerable tr-timthumb shortcode

Discovery Timeline

2025-12-06 - CVE-2025-13899 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13899

Vulnerability Analysis

The TR Timthumb plugin registers a shortcode that accepts user-controlled attributes and renders them directly into page markup. According to the plugin source at inc/front.php, attribute values are concatenated into HTML output without invoking WordPress escaping functions such as esc_attr() or esc_html().

This allows a Contributor to submit a post containing a shortcode with attribute values that break out of their intended HTML context. When an editor, administrator, or unauthenticated site visitor later loads the page, the injected script executes with the privileges of that browsing session. Contributor accounts are frequently self-registered on multi-author blogs, lowering the barrier to exploitation.

Root Cause

The root cause is missing input sanitization combined with missing output escaping in the shortcode rendering path. WordPress provides context-aware escaping helpers, but the plugin renders shortcode attributes to the DOM without applying them. This creates a stored injection sink where attacker-controlled data is persisted in the post body and later reflected to every viewer of that post.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at Contributor level or above. The attacker authors a post containing the tr-timthumb shortcode with a crafted attribute value carrying a JavaScript payload. Once the post is published or previewed by a higher-privileged user, the payload executes in that user's browser under the site's origin. Because the scope is changed (S:C), the impact reaches beyond the vulnerable component to any user session interacting with the rendered page.

No verified public proof-of-concept code is available. See the Wordfence advisory for additional technical context.

Detection Methods for CVE-2025-13899

Indicators of Compromise

Posts or pages containing [tr-timthumb ...] shortcodes with attribute values that include <script>, onerror=, onload=, or javascript: substrings
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after viewing content authored by Contributor accounts
New administrator accounts, modified user roles, or altered plugin/theme files created shortly after content authored by lower-privileged users is viewed

Detection Strategies

Query the wp_posts table for post_content values matching the tr-timthumb shortcode with suspicious attribute payloads
Review recent Contributor and Author activity for posts that trigger content security policy (CSP) violations in browser telemetry
Correlate WordPress audit logs of post submissions with subsequent administrator authentication and privilege-change events

Monitoring Recommendations

Enable a Web Application Firewall (WAF) ruleset that inspects shortcode attribute payloads for HTML and JavaScript metacharacters
Alert on any modification to wp_users, wp_usermeta, or plugin PHP files following Contributor post submissions
Deploy browser-side CSP reporting to capture inline script executions on pages containing the vulnerable shortcode

How to Mitigate CVE-2025-13899

Immediate Actions Required

Deactivate the TR Timthumb plugin on any WordPress site running version 1.0.4 or earlier until a patched release is confirmed
Audit all existing posts for the tr-timthumb shortcode and remove or sanitize any attribute values containing script content
Review Contributor, Author, and Editor accounts, revoking access for users that are not required to publish content

Patch Information

At the time of publication, no fixed version is listed in the Wordfence advisory. Monitor the official plugin repository for a release addressing the shortcode sanitization gap and upgrade immediately when available.

Workarounds

Restrict user registration and disable self-service Contributor account creation
Configure a WAF rule to block requests containing [tr-timthumb combined with HTML tag characters in POST bodies to /wp-admin/post.php
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources
Replace the plugin with an actively maintained image-processing alternative if the vendor does not publish a fix

bash

# Configuration example: locate posts containing the vulnerable shortcode
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[tr-timthumb%' AND post_status IN ('publish','draft','pending');"

# Disable the plugin site-wide until a patch is released
wp plugin deactivate tr-timthumb