CVE-2025-13693 is a stored cross-site scripting vulnerability in the wpchill Image Photo Gallery Final Tiles Grid WordPress plugin (versions up to 3.6.8). The flaw exists due to improper neutralization of input in the 'Custom scripts' setting, allowing authenticated users with Author-level access or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the Author level.

Successful exploitation allows an authenticated user with Author-level or higher privileges to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to information disclosure or session hijacking. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per the CVSS vector.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict Author-level access to trusted users only and consider disabling or limiting use of the 'Custom scripts' setting in the plugin to reduce risk.