CVE-2025-13903

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The PullQuote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pullquote' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-139046.4The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up CVE-2025-139057.0CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or mo CVE-2025-139066.4The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, CVE-2025-139076.4The CSS3 Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to CVE-2025-139086.4The The Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'the_tooltip' shortcode in all versions u CVE-2025-139094.3The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic CVE-2025-13915.4A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username CVE-2025-139106.1The WP-WebAuthn plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the `wwa_auth` AJAX endpoint in all ve CVE-2025-139116.4Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code CVE-2025-139121.0Multiple constant-time implementations in wolfSSL before version 5.8.4 may be transformed into non-constant-time binary by LLVM optimization CVE-2025-139136.8A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which executes embedded m CVE-2025-139148.1A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MI