CVE-2025-13895 is a reflected cross-site scripting vulnerability in the Top Position Google Finance WordPress plugin (up to version 0.1.0). The issue arises from insufficient input sanitization and output escaping of the $_SERVER['PHP_SELF'] variable, enabling attackers to inject arbitrary web scripts. This vulnerability requires user interaction (clicking a malicious link) and can lead to partial confidentiality and integrity impacts without affecting availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure and manipulation of site content as perceived by users. The vulnerability does not impact system availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected pages. Applying web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation. Avoid clicking on suspicious links that could exploit this vulnerability.