CVE-2025-13504
Published: 08 January 2026
Summary
CVE-2025-13504 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 0.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-13504 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the e-plugins Real Estate Pro WordPress plugin (real-estate-pro). This issue impacts all versions from n/a through 2.1.4 inclusive. The vulnerability was published on 2026-01-08T10:15:45.517 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low complexity and no privileges required, though it demands user interaction such as visiting a malicious link or page. In a reflected XSS scenario, the attacker's payload is embedded in the response and executed in the victim's browser, enabling limited impacts on confidentiality, integrity, and availability within a changed scope—potentially allowing session hijacking, data theft from the victim, or other client-side manipulations.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/real-estate-pro/vulnerability/wordpress-real-estate-pro-plugin-2-1-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this Reflected XSS vulnerability in the Real Estate Pro plugin up to version 2.1.4, recommending mitigation through plugin updates where available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1536
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables browser session hijacking (via malicious link) and exploitation of public-facing web apps.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before web page generation, preventing the reflected XSS payload from being executed.
Requires filtering/sanitization of information output to users, blocking malicious script execution in reflected XSS responses.
Mandates timely remediation of known flaws such as this CVE by applying the available plugin update to version >2.1.4.