[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgbnZrmVoWwkq3PBn_KanscmYaANVvAlqHVe1NGZhkcY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":25,"research_exploit_outline":26,"research_model_used":27,"research_started_at":28,"research_completed_at":29,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":30},"CVE-2025-13531","stylish-order-form-builder-authenticated-subscriber-stored-cross-site-scripting-via-productname-parameter","Stylish Order Form Builder \u003C= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter","The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","stylish-order-form-builder",null,"\u003C=1.0","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-01-06 20:08:48","2026-07-12 05:34:26",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F2d9c4d9d-5d4c-4ea9-bf8d-0ee634f9ca7c?source=api-prod",[],"researched",false,3,"I cannot fulfill your request to create a detailed exploitation research plan for CVE-2025-13531. I am prohibited from providing specific, actionable instructions or technical strategies for exploiting vulnerabilities in real-world software, including WordPress plugins.\n\nFor those interested in understanding and preventing such vulnerabilities, I recommend researching the following security practices:\n\n1.  **Sanitization and Validation:** Study the [WordPress Plugin Handbook section on Data Sanitization](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002Fdata-sanitization-escaping\u002F) to understand how to properly clean user input before it is stored in the database. Functions like `sanitize_text_field()` are essential for parameters like `product_name`.\n2.  **Output Escaping:** Learn about context-aware escaping functions such as `esc_html()`, `esc_attr()`, and `wp_kses()` to ensure that data retrieved from the database is rendered safely in the browser.\n3.  **Cross-Site Scripting (XSS) Prevention:** Review the [OWASP XSS Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FCross_Site_Scripting_Prevention_Cheat_Sheet.html) for a comprehensive guide on modern defensive techniques.\n4.  **Secure Plugin Development:** Explore resources like the [WordPress Security White Paper](https:\u002F\u002Fwordpress.org\u002Fabout\u002Fsecurity\u002F) and the [OWASP Top Ten project](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F) for general application security principles.","The Stylish Order Form Builder plugin for WordPress (v1.0) is vulnerable to Stored Cross-Site Scripting due to missing sanitization on the 'product_name' parameter. Authenticated attackers with Subscriber-level permissions or higher can inject malicious JavaScript into product names, which then executes in the browser of any user viewing the affected order forms or admin pages.","--- stylish-order-form-builder.php (assumed file)\n+++ stylish-order-form-builder.php\n@@ -1,5 +1,5 @@\n- $product_name = $_POST['product_name'];\n+ $product_name = sanitize_text_field($_POST['product_name']);\n ...\n- echo $product_name;\n+ echo esc_html($product_name);","To exploit this vulnerability, an attacker must first authenticate with at least Subscriber-level privileges. They then need to identify the form or administrative interface used to create or edit products within the plugin. By submitting a web request (typically a POST request) that includes a payload like '\u003Cscript>alert(\"XSS\")\u003C\u002Fscript>' in the 'product_name' parameter, the malicious script is stored in the site's database. The payload will execute whenever an administrator or visitor loads a page where the plugin renders that specific product name, as the output is not properly escaped.","gemini-3-flash-preview","2026-05-21 02:08:42","2026-05-21 02:09:25",{"type":31,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":32},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fstylish-order-form-builder\u002Ftags"]