CVE-2025-13959: Filestack WordPress Plugin XSS Vulnerability

CVE-2025-13959 Overview

The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin's filepicker shortcode in all versions up to, and including, 2.0.8. The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes within the shortcode implementation. This security flaw enables authenticated attackers with contributor-level access and above to inject arbitrary web scripts into WordPress pages that will execute whenever a user accesses the compromised page.

Critical Impact

Attackers with contributor-level WordPress access can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

Affected Products

• Filestack WordPress Plugin versions up to and including 2.0.8
• WordPress installations using the vulnerable filepicker shortcode functionality
• WordPress sites with contributor-level or higher user accounts

Discovery Timeline

• 2026-02-18 - CVE-2025-13959 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-13959

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The Stored XSS variant is particularly dangerous because the malicious payload persists in the WordPress database and executes each time a user views the affected page.

The vulnerability exists in the shortcode processing logic within the shortcodes.php file. When the filepicker shortcode is rendered, user-supplied attributes are not properly sanitized before being included in the HTML output. This allows an attacker to craft malicious attribute values containing JavaScript code that will be executed in the context of any user's browser session when viewing the page.

The attack requires only contributor-level access, which is a relatively low privilege level in WordPress. Contributors can create and edit their own posts but cannot publish them without approval. However, the malicious shortcode content persists in drafts and becomes active once the post is published by an administrator or editor.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the filepicker shortcode handler located in lib/shortcodes.php. The vulnerable code at line 20 processes shortcode attributes without applying proper WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses() before outputting them to the page.

WordPress provides built-in sanitization and escaping functions specifically designed to prevent XSS attacks, but these were not implemented for the user-controllable shortcode attributes in the affected plugin versions.

Attack Vector

The attack is network-based and requires low-privilege authentication (contributor-level access). An attacker can exploit this vulnerability by creating or editing a post containing the filepicker shortcode with malicious attribute values. The injected script will execute in the browser context of any authenticated user who views the page, including administrators.

Typical attack payloads could include:

• Session cookie theft to hijack administrator sessions
• Keylogger injection to capture credentials
• Drive-by download triggers for malware distribution
• Defacement or content manipulation
• Redirection to phishing pages

The vulnerability does not require user interaction beyond viewing the affected page, and the scope is changed (affecting users beyond the vulnerable component), as indicated by the CVSS vector.

Detection Methods for CVE-2025-13959

Indicators of Compromise

• Unexpected JavaScript code within WordPress posts containing the filepicker shortcode
• Suspicious shortcode attributes containing <script>, javascript:, onerror=, onload=, or similar event handlers
• Unusual outbound requests from client browsers when viewing WordPress pages
• Modified post content in the wp_posts database table with embedded script tags

Detection Strategies

• Review WordPress posts and pages for filepicker shortcodes with suspicious attribute values
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Monitor server access logs for unusual patterns from contributor-level user accounts
• Deploy web application firewall (WAF) rules to detect XSS payloads in WordPress shortcode attributes

Monitoring Recommendations

• Enable WordPress audit logging to track post creation and modification by contributor accounts
• Configure browser-based XSS detection through CSP violation reporting
• Regularly scan WordPress content database for known XSS payload patterns
• Monitor for abnormal session activity that could indicate session hijacking

How to Mitigate CVE-2025-13959

Immediate Actions Required

• Update the Filestack WordPress plugin to a version newer than 2.0.8 when a patched version becomes available
• Audit existing WordPress posts for any malicious content within filepicker shortcodes
• Review contributor and author-level user accounts for unauthorized access
• Consider temporarily disabling the Filestack plugin until a patched version is available

Patch Information

A security patch addressing this vulnerability should be obtained from the WordPress plugin repository. Review the Wordfence Vulnerability Report for updated patch information and the WordPress Plugin Source Code for the latest development version.

Administrators should verify that the updated plugin version properly implements input sanitization using WordPress escaping functions for all shortcode attributes before deployment.

Workarounds

• Restrict contributor and author-level access to trusted users only until the plugin is patched
• Remove the Filestack plugin if the filepicker shortcode functionality is not critical to operations
• Implement a Web Application Firewall (WAF) with XSS protection rules targeting shortcode attribute injection
• Add custom input validation through a WordPress filter hook to sanitize filepicker shortcode attributes

# Configuration example
# WordPress .htaccess XSS protection header
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "script-src 'self'; object-src 'none'"
</IfModule>