CVE-2025-13418 is a stored cross-site scripting vulnerability in the Responsive Pricing Table plugin for WordPress by spwebguy. The flaw exists in the handling of the 'plan_icons' parameter, which lacks proper input sanitization and output escaping, allowing authenticated users with Author-level privileges or above to inject arbitrary scripts. These scripts execute in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 5.1.12. The CVSS 3.1 base score is 6.4, reflecting a network attack vector, low attack complexity, and privileges required at the Author level without user interaction.

An attacker with Author-level access or higher can exploit this vulnerability to inject and store malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure or manipulation of user sessions. The impact is limited by the requirement for authenticated access at a relatively high privilege level and does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider removing or disabling the Responsive Pricing Table plugin if possible. Monitor for updates from the vendor or spwebguy regarding patches or mitigations.