Reflected Cross-Site Scripting in Application Passwords Plugin for WordPress

CVE-2025-13308

What is CVE-2025-13308?

The Application Passwords plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to exploit the 'reject_url' parameter through reflected cross-site scripting. This weakness arises from insufficient sanitization and escaping of user-supplied URLs. By embedding malicious javascript: URI schemes within the reject_url, attackers can inject arbitrary scripts that execute when users interact with a deceptive link, potentially leading to unauthorized actions on behalf of the victim.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References