Stored Cross-Site Scripting Vulnerability in Nexter Extension for WordPress
CVE-2025-13731

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
Vendor
CVE Published:
2 December 2025

What is CVE-2025-13731?

The Nexter Extension – Site Enhancements Toolkit plugin for WordPress exhibits a vulnerability that enables stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping in the 'nxt-year' shortcode. Authenticated attackers with Contributor-level access or higher can exploit this flaw, allowing them to inject malicious web scripts that execute whenever users access compromised pages. This vulnerability poses significant risks to site integrity and user security, necessitating prompt remediation for all affected versions.

Affected Version(s)

Nexter Extension – Security, Performance, Code Snippets & Site Toolkit 0 <= 4.4.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/nexter-extensi...
https://plugins.trac.wordpress.org/browser/nexter-extensi...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
.