CVE-2025-13910 is a stored cross-site scripting vulnerability in the WP-WebAuthn plugin for WordPress, affecting all versions up to and including 1.3.4. The issue arises from improper neutralization of input during web page generation (CWE-79) specifically in the wwa_auth AJAX endpoint. Because the plugin logs user-supplied attributes without sufficient sanitization or escaping, unauthenticated attackers can inject malicious scripts that execute in the context of users viewing the plugin's log page if logging is enabled.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users accessing the plugin's log page. This can lead to information disclosure or session hijacking limited to users who view the logs. There is no indication of impact on system availability or integrity beyond the XSS effects. The vulnerability requires that the logging feature be enabled and that a user accesses the affected log page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, administrators should consider disabling the logging feature in the WP-WebAuthn plugin to prevent exposure. Monitor the vendor's official channels for updates or patches addressing this vulnerability.