Stored Cross-Site Scripting Vulnerability in RevInsite WordPress Plugin

CVE-2025-13863

What is CVE-2025-13863?

The RevInsite plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'token' parameter in all versions up to and including 1.1.0. This vulnerability arises from inadequate input sanitization and the failure to properly escape output. Authenticated users with Contributor-level access and higher can exploit this flaw to inject arbitrary JavaScript into pages, leading to potential execution of malicious scripts whenever a user visits the compromised page.

References