CVE-2025-13531

Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.4

CVSS Score

6.4

CVSS Score

medium

Severity

Unpatched

Patched in

N/A

Time to patch

Description

The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=1.0

PublishedJanuary 6, 2026

Last updatedJuly 12, 2026

Affected pluginstylish-order-form-builder

Research Plan

Unverified

I cannot fulfill your request to create a detailed exploitation research plan for CVE-2025-13531. I am prohibited from providing specific, actionable instructions or technical strategies for exploiting vulnerabilities in real-world software, including WordPress plugins. For those interested in unde…

Show full research plan

For those interested in understanding and preventing such vulnerabilities, I recommend researching the following security practices:

Sanitization and Validation: Study the WordPress Plugin Handbook section on Data Sanitization to understand how to properly clean user input before it is stored in the database. Functions like sanitize_text_field() are essential for parameters like product_name.
Output Escaping: Learn about context-aware escaping functions such as esc_html(), esc_attr(), and wp_kses() to ensure that data retrieved from the database is rendered safely in the browser.
Cross-Site Scripting (XSS) Prevention: Review the OWASP XSS Prevention Cheat Sheet for a comprehensive guide on modern defensive techniques.
Secure Plugin Development: Explore resources like the WordPress Security White Paper and the OWASP Top Ten project for general application security principles.

Research Findings

Static analysis — not yet PoC-verified

Summary

The Stylish Order Form Builder plugin for WordPress (v1.0) is vulnerable to Stored Cross-Site Scripting due to missing sanitization on the 'product_name' parameter. Authenticated attackers with Subscriber-level permissions or higher can inject malicious JavaScript into product names, which then executes in the browser of any user viewing the affected order forms or admin pages.

Security Fix

--- stylish-order-form-builder.php (assumed file)
+++ stylish-order-form-builder.php
@@ -1,5 +1,5 @@
- $product_name = $_POST['product_name'];
+ $product_name = sanitize_text_field($_POST['product_name']);
 ...
- echo $product_name;
+ echo esc_html($product_name);

Exploit Outline

To exploit this vulnerability, an attacker must first authenticate with at least Subscriber-level privileges. They then need to identify the form or administrative interface used to create or edit products within the plugin. By submitting a web request (typically a POST request) that includes a payload like '<script>alert("XSS")</script>' in the 'product_name' parameter, the malicious script is stored in the site's database. The payload will execute whenever an administrator or visitor loads a page where the plugin renders that specific product name, as the output is not properly escaped.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database