Reflected Cross-Site Scripting in Application Passwords Plugin for WordPress

CVE-2025-13308

What is CVE-2025-13308?

The Application Passwords plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to exploit the 'reject_url' parameter through reflected cross-site scripting. This weakness arises from insufficient sanitization and escaping of user-supplied URLs. By embedding malicious javascript: URI schemes within the reject_url, attackers can inject arbitrary scripts that execute when users interact with a deceptive link, potentially leading to unauthorized actions on behalf of the victim.

References