CVE-2025-13993 is a stored cross-site scripting vulnerability in the MailerLite – Signup forms (official) WordPress plugin. It affects versions up to and including 1.7.16 and is caused by improper neutralization of input in the 'form_description' and 'success_message' parameters. Authenticated attackers with administrator-level access can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 5.5, indicating medium severity. No patch or remediation details have been provided, and no known exploits are currently reported.

Successful exploitation allows an authenticated administrator to inject malicious scripts that execute in the browsers of users who access the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. Availability is not affected. The vulnerability requires high privileges (administrator access) and does not require user interaction beyond viewing the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to form descriptions and success messages. Avoid using untrusted input in these parameters. Follow updates from the MailerLite vendor for any forthcoming patches or official mitigations.