CVE-2025-13960 is a stored cross-site scripting vulnerability in the GPXpress WordPress plugin (versions up to 1.3). It results from improper neutralization of input during web page generation (CWE-79), specifically due to inadequate sanitization and output escaping of user-supplied attributes in the 'gpxpress' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users who visit the infected pages. This can lead to theft of user credentials, session hijacking, or other actions limited to the scope of the injected script. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

Patch status is not yet confirmed — no official fix or patch information is provided. Users should monitor the vendor's advisory channels for updates. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the GPXpress plugin if possible to prevent exploitation.