CVE-2025-13968: WordPress Starboard Suite XSS Vulnerability

CVE-2025-13968 Overview

CVE-2025-13968 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Starboard Suite Reservation Calendars plugin for WordPress. The flaw affects all versions up to and including 3.1.4. The vulnerability exists in the [starboard-suite-lightbox] shortcode, where attributes are not properly sanitized on input or escaped on output.

Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The script executes in the browser of any user who views the affected page, enabling session theft, forced redirection, or account takeover of higher-privileged users.

Critical Impact
Contributor-level users can inject persistent JavaScript that executes against site visitors and administrators, enabling privilege escalation through admin session hijacking.

Affected Products

Starboard Suite Reservation Calendars plugin for WordPress
All versions through 3.1.4
WordPress sites permitting Contributor-level user registration

Discovery Timeline

2026-07-11 - CVE-2025-13968 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2025-13968

Vulnerability Analysis

The Starboard Suite Reservation Calendars plugin registers the [starboard-suite-lightbox] shortcode to embed reservation lightbox content. The shortcode handler accepts attributes supplied by the content author and reflects them into rendered HTML. The plugin fails to apply WordPress sanitization APIs such as sanitize_text_field() on input or escaping helpers such as esc_attr() and esc_html() on output.

An attacker with Contributor privileges can save a post containing the shortcode with malicious attribute values. Once the post is viewed, the injected script executes in the victim's browser under the site's origin. Because the attack payload is persisted in the database, every visit to the page re-triggers execution, giving the attacker durable footholds against reviewers, editors, and administrators.

Root Cause

The root cause is insufficient input sanitization and output escaping in the shortcode handler. Vulnerable code paths are documented at line 64 and line 78 of starboard-suite.php in the plugin source tree. See the WordPress Plugin Code Reference (line 64) and WordPress Plugin Code Reference (line 78).

Attack Vector

Exploitation requires a network-reachable WordPress instance and an authenticated account with Contributor role or above. The attacker authors a post or page containing the [starboard-suite-lightbox] shortcode with crafted attribute values carrying an XSS payload. When an administrator previews or a visitor loads the page, the browser parses the unescaped attribute and executes the attacker-controlled script in the site context. The scope change reflected in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, including higher-privileged sessions. Refer to the Wordfence Vulnerability Report for the technical writeup.

Detection Methods for CVE-2025-13968

Indicators of Compromise

Post or page content containing [starboard-suite-lightbox] shortcode with attributes holding <script>, on*= event handlers, or javascript: URIs.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting posts authored by Contributor accounts.
New administrative users, altered options, or unauthorized plugin installations following Contributor content submissions.

Detection Strategies

Query the wp_posts table for post_content matching the shortcode name combined with suspicious attribute values such as onerror, onload, <script, or encoded equivalents.
Review Contributor and Author submissions during editorial workflow, focusing on shortcode attribute contents before approval.
Monitor web server logs for anomalous parameter reflection and Content Security Policy violation reports originating from pages using the plugin.

Monitoring Recommendations

Alert on creation or edit of WordPress posts by Contributor-level accounts that embed the vulnerable shortcode.
Track administrator session activity for anomalies such as unexpected role changes, plugin edits, or password resets shortly after previewing pending content.
Ingest WordPress audit and PHP error logs into a SIEM to correlate shortcode use with follow-on privileged actions.

How to Mitigate CVE-2025-13968

Immediate Actions Required

Update the Starboard Suite Reservation Calendars plugin to a version later than 3.1.4 once released, or deactivate and remove the plugin if no patched build is available.
Audit existing posts and pages for the [starboard-suite-lightbox] shortcode and inspect attribute values for injected scripts.
Review Contributor, Author, and Editor accounts, disabling any unused or suspicious users and enforcing strong authentication.

Patch Information

A plugin code change is tracked in the WordPress Code Changeset. Site administrators should apply the vendor update through the WordPress plugin manager as soon as a fixed release is published and confirmed by the Wordfence Vulnerability Report.

Workarounds

Restrict Contributor and Author roles on production sites until the plugin is updated, or require editorial review before publishing any content that contains shortcodes.
Deploy a web application firewall rule that blocks requests containing [starboard-suite-lightbox] shortcode attributes with script tags, event handlers, or javascript: URIs.
Enforce a strict Content Security Policy that disallows inline scripts and unknown script origins to reduce XSS impact on rendered pages.

bash

# Example: locate posts containing the vulnerable shortcode for manual review
wp db query "SELECT ID, post_title, post_author, post_status \
  FROM wp_posts \
  WHERE post_content LIKE '%[starboard-suite-lightbox%' \
  AND post_status IN ('publish','pending','draft');"