Reflected Cross-Site Scripting in Top Position Google Finance Plugin for WordPress

CVE-2025-13895

What is CVE-2025-13895?

The Top Position Google Finance plugin for WordPress exhibits a vulnerability allowing reflected cross-site scripting due to inadequate input validation and output filtering. Attackers can exploit this flaw through the $_SERVER['PHP_SELF'] variable, enabling them to inject harmful scripts. If users are deceived into interacting with compromised links, their sessions could be hijacked or malicious scripts executed in their browsers. All versions of the plugin up to and including 0.1.0 are affected, emphasizing the need for site administrators to ensure their plugins are updated and to implement the necessary security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References