CVE-2025-13971
Stored XSS in TWW Protein Calculator WordPress Plugin Header Setting
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | tww_protein_calculator | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is a Stored Cross-Site Scripting (XSS) issue in the TWW Protein Calculator plugin for WordPress, affecting versions up to 1.0.24. It occurs via the 'Header' setting due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute when users access the injected pages. This vulnerability affects only multi-site installations and installations where unfiltered_html is disabled.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator access to inject malicious scripts into pages, which execute when other users view those pages. This can lead to unauthorized actions, data theft, or session hijacking for users accessing the affected pages, potentially compromising site security and user data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that only trusted administrators have access to the WordPress multi-site installation, especially those with the ability to modify the 'Header' setting in the TWW Protein Calculator plugin. Disable or restrict administrator-level access where possible. Additionally, consider disabling or enabling 'unfiltered_html' carefully, as the vulnerability affects installations where 'unfiltered_html' is disabled. Monitor for plugin updates and apply patches when available.