CVE-2025-13968 is a stored cross-site scripting vulnerability in the Starboard Suite Reservation Calendars plugin for WordPress. It arises from improper neutralization of input during web page generation (CWE-79) specifically in the shortcode attributes of the [starboard-suite-lightbox] shortcode. The flaw allows authenticated attackers with Contributor-level privileges or above to inject arbitrary web scripts that execute in the context of users visiting the injected pages. This affects all plugin versions up to and including 3.1.4. No official patch or remediation has been confirmed as of the published date.

Successful exploitation allows an attacker with Contributor-level access to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to information disclosure and integrity impacts, such as theft of user credentials or session tokens. Availability is not impacted. The vulnerability requires authenticated access, limiting the attack surface to users with at least Contributor privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the affected shortcode. Monitor for updates from the vendor regarding patches or official mitigations.