CVE-2025-13701 is a reflected XSS vulnerability in the beshkin Shabat Keeper WordPress plugin (versions up to 0.4.4). It arises from improper neutralization of input in the $_SERVER['PHP_SELF'] parameter, allowing injection of malicious scripts that execute in the context of the victim's browser when they click a crafted link. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of cookies, session tokens, or other sensitive information accessible to the browser. The impact is limited to confidentiality and integrity with no direct impact on availability. The vulnerability affects unauthenticated users and requires user interaction.

No official patch or fix is currently available for this vulnerability. Users of the Shabat Keeper plugin should monitor the vendor's communications for updates or patches. As a temporary mitigation, administrators can consider disabling or removing the plugin until a fix is released. Additionally, applying web application firewall (WAF) rules to block suspicious requests targeting the $_SERVER['PHP_SELF'] parameter may reduce risk. Avoid clicking on suspicious links that could exploit this vulnerability.