CVE-2025-13899 is a stored cross-site scripting vulnerability in the pntrinh TR Timthumb WordPress plugin affecting all versions up to 1.0.4. The issue arises from insufficient sanitization and escaping of shortcode attributes, allowing authenticated users with Contributor or higher privileges to inject arbitrary scripts into pages. These scripts execute in the context of any user viewing the affected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. No known exploits in the wild or vendor patches have been documented as of the published date.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into WordPress pages via shortcode attributes. This can lead to unauthorized script execution in users' browsers, impacting confidentiality and integrity of user data. The vulnerability does not affect availability. Since the attacker must be authenticated with at least Contributor privileges, the risk is limited to environments where such user roles are assigned.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the TR Timthumb plugin if possible. Monitor plugin updates from the vendor for an official fix.