CVE-2025-13705 is a stored cross-site scripting vulnerability in the blakelong Custom Frames WordPress plugin affecting all versions up to 1.0.1. The issue is due to improper neutralization of input in the 'class' parameter of the 'customframe' shortcode, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or manipulation of page content. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode parameter. This can lead to unauthorized disclosure of information or manipulation of page content for users who view the affected pages. There is no direct impact on availability. The vulnerability affects confidentiality and integrity, with a medium severity rating (CVSS 6.4). No known exploits in the wild have been reported.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Custom Frames plugin if feasible to mitigate risk.