CVE-2025-13625 is a reflected cross-site scripting vulnerability in the WP-SOS-Donate Donation Sidebar Plugin for WordPress, affecting all versions up to and including 0.9.2. The issue stems from improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, which is used during web page generation without adequate sanitization or escaping. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser if the victim clicks a crafted link. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting a medium impact on confidentiality and integrity with no impact on availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of user interactions. The vulnerability does not impact system availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP-SOS-Donate Donation Sidebar Plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block malicious input targeting the $_SERVER['PHP_SELF'] parameter may help mitigate exploitation attempts.