Atomic Edge analysis of CVE-2025-13531 (metadata-based):
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the Stylish Order Form Builder WordPress plugin. The ‘product_name’ parameter lacks proper sanitization and output escaping. Attackers with Subscriber-level or higher privileges can inject malicious scripts that persist and execute when affected pages load. The CVSS 6.4 score reflects medium severity with scope change and low impact on confidentiality and integrity.

Atomic Edge research identifies the root cause as insufficient input sanitization and output escaping for the ‘product_name’ parameter. The CWE-79 classification confirms improper neutralization of input during web page generation. Without code diff access, this conclusion is inferred from the vulnerability description and CWE mapping. The plugin likely processes user-supplied product names without applying WordPress sanitization functions like `sanitize_text_field()` or output escaping functions like `esc_html()` before storage and display.

Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker submits a crafted request containing JavaScript payloads in the ‘product_name’ parameter. This parameter likely appears in an order form creation or management interface, possibly via AJAX handlers or admin POST endpoints. A typical payload might be `alert(document.cookie)` or more sophisticated exfiltration scripts. The injected script executes in victims’ browsers when they view pages containing the malicious product name.

Remediation requires implementing proper input validation and output escaping. Developers should apply WordPress core sanitization functions like `sanitize_text_field()` or `wp_kses_post()` before storing the ‘product_name’ value. Output escaping functions like `esc_html()` or `esc_attr()` must be used when displaying the value in HTML contexts. WordPress nonce verification and capability checks should also be present to prevent CSRF attacks and ensure proper authorization.

Successful exploitation allows attackers to perform actions within victims’ sessions. Attackers can steal session cookies, redirect users to malicious sites, or modify page content. Since the vulnerability affects authenticated users, attackers could target administrators to gain higher privileges. The stored nature means a single injection affects all users viewing the compromised page, amplifying the attack’s reach.