CVE-2025-13968

Published Jul 11, 2026

Last updated 5 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13968 identifies a Stored Cross-Site Scripting (XSS) vulnerability within the Starboard Suite Reservation Calendars plugin for WordPress. This flaw affects all versions of the plugin up to and including 3.1.4. The vulnerability stems from inadequate input sanitization and output escaping in the shortcode attributes, specifically within the `[starboard-suite-lightbox]` shortcode. This oversight enables authenticated attackers, possessing Contributor-level access or higher, to inject arbitrary web scripts into pages. These injected scripts then execute whenever a user accesses a page containing the malicious code.

Description: The Starboard Suite Reservation Calendars plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in the [starboard-suite-lightbox] shortcode in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: security@wordfence.com
NVD status: Deferred

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.4
Impact score: 2.7
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

security@wordfence.com: CWE-79

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References