CVE-2025-13907 is a stored cross-site scripting vulnerability in the tunilame CSS3 Buttons WordPress plugin, affecting all versions up to and including 0.1. The flaw arises from insufficient input sanitization and output escaping of user-supplied attributes in the plugin's 'button' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS score of 6.4 (medium severity) and does not require user interaction to trigger once the malicious content is stored. No known exploits in the wild have been reported. A patch is available to remediate this issue.

An attacker with contributor-level or higher access can inject malicious JavaScript into pages via the vulnerable shortcode, which executes in the browsers of users who view those pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on availability. The vulnerability requires authenticated access and is rated medium severity with a CVSS score of 6.4.

A patch is available for this vulnerability and should be applied promptly to all affected installations of the CSS3 Buttons plugin. Updating to a fixed version will address the insufficient input sanitization and output escaping issues. Until patched, restrict contributor-level access if possible to reduce risk. Monitor vendor advisories for the official patch release and instructions.