CVE-2025-13893 is a reflected cross-site scripting vulnerability in the burtrw Lesson Plan Book WordPress plugin (versions up to 1.3). The issue arises from improper neutralization of input in the $_SERVER['PHP_SELF'] variable, which is used during web page generation without adequate sanitization or escaping. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users who click on crafted links, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser when the victim clicks a malicious link. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. No known exploits are currently reported in the wild.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the vulnerable plugin or applying manual input sanitization and output escaping if feasible. Additionally, educating users to avoid clicking suspicious links can reduce risk.