CVE-2025-13682 is a stored cross-site scripting vulnerability in the Trail Manager WordPress plugin (versions up to 1.0.0). It arises from improper neutralization of input during web page generation, allowing authenticated administrators to inject malicious scripts via admin settings. The vulnerability is limited to multi-site installations or those with unfiltered_html disabled, increasing the risk of script execution in affected pages. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction.

An attacker with administrator-level access can inject persistent malicious scripts into pages managed by the Trail Manager plugin. These scripts execute whenever a user accesses the injected page, potentially leading to data theft, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires high privileges, limiting its exploitation scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully control and monitor administrator-level access, especially in multi-site environments and where unfiltered_html is disabled. Avoid using the vulnerable plugin version or disable it if possible to mitigate risk.