CVE-2025-13731: Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nxt-year' shortcode in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13731?
CVE-2025-13731 has a high severity due to its potential to allow Stored Cross-Site Scripting attacks.
How do I fix CVE-2025-13731?
To fix CVE-2025-13731, update the Nexter Extension – Site Enhancements Toolkit plugin to version 4.4.2 or later.
What versions are affected by CVE-2025-13731?
CVE-2025-13731 affects all versions of the Nexter Extension plugin up to and including version 4.4.1.
What kind of attacks can exploit CVE-2025-13731?
CVE-2025-13731 can be exploited to perform Stored Cross-Site Scripting attacks, potentially compromising user data.
Who is the vendor for CVE-2025-13731?
The vendor for CVE-2025-13731 is Nexter, associated with the Nexter Extension plugin.