CVE-2025-13892 is a reflected cross-site scripting vulnerability in the MG AdvancedOptions plugin for WordPress. The issue arises from improper neutralization of input in the $_SERVER['PHP_SELF'] variable, which is used in web page generation without sufficient sanitization or escaping. This allows attackers to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted URL. The vulnerability affects all versions up to and including 1.2 of the plugin. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible to the browser. The vulnerability requires user interaction (clicking a malicious link) and does not grant direct system access or availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor the mountaingrafix vendor channels for updates. As a temporary mitigation, administrators can consider disabling or removing the MG AdvancedOptions plugin until a fix is available. Additionally, employing web application firewalls (WAFs) that detect and block reflected XSS attempts may reduce risk.