CVE-2025-13676 is a reflected cross-site scripting vulnerability in the ostin654 JustClick registration plugin for WordPress. The issue arises from insufficient input sanitization and output escaping of the PHP_SELF server variable, enabling attackers to inject arbitrary web scripts. This vulnerability affects all versions up to and including 0.1. Exploitation requires user interaction, such as clicking a malicious link. The CVSS 3.1 base score is 6.1, reflecting a medium severity impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial confidentiality and integrity impact without availability impact.

Successful exploitation can lead to the execution of attacker-controlled scripts in the context of the affected website, potentially allowing theft of user credentials, session hijacking, or other malicious actions limited to the confidentiality and integrity of user data. There is no impact on system availability. The vulnerability requires user interaction and does not require authentication.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the JustClick registration plugin or implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the PHP_SELF parameter. Avoid clicking on suspicious links that may exploit this vulnerability.