CVE-2025-13969 is a stored cross-site scripting vulnerability in the Reviews Sorted WordPress plugin (versions up to 2.4.2). It occurs due to improper neutralization of input in the 'space' parameter of the [reviews-slider] shortcode, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (medium severity). No patch or official fix details are currently available.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode parameter. This can lead to unauthorized script execution in the browsers of users who view the affected pages, potentially compromising user sessions or data confidentiality. The vulnerability does not affect availability and requires authenticated access, limiting its impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Reviews Sorted plugin if possible to prevent exploitation.