WP Hallo Welt <= 1.4. - Cross-Site Request Forgery zu Stored Cross-Site Scripting

The primary impact of CVE-2025-13365 is the potential for attackers to inject malicious JavaScript code into WordPress websites using the WP Hallo Welt plugin. Successful exploitation could lead to session hijacking, defacement of the website, redirection to malicious sites, or the theft of sensitive user data. Because the vulnerability leverages CSRF, an attacker doesn't need to authenticate but can trick an administrator into executing a forged request. The stored nature of the XSS means the injected script persists on the server and can affect multiple visitors. This is particularly concerning for sites with high traffic or sensitive data.

Websites using the WP Hallo Welt plugin, particularly those with administrator accounts that are frequently targeted by phishing or social engineering attacks, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / plugin: Use wp-cli to check the installed plugin version:

wp plugin list | grep hallo-welt

• wordpress / plugin: Search plugin files for the halloweltseite function and look for missing or incorrect nonce validation. • generic web: Monitor WordPress error logs for suspicious JavaScript code being injected into plugin settings. • generic web: Check WordPress admin user activity logs for unusual or unauthorized changes to plugin settings.

1. 2025-12-20Disclosure

   disclosure

1. Reserviert2025-11-18
2. Veröffentlicht2025-12-20
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The immediate mitigation for CVE-2025-13365 is to upgrade to a patched version of the WP Hallo Welt plugin as soon as it becomes available. Until a patch is released, administrators should exercise extreme caution when clicking links or performing actions within the WordPress dashboard, especially if they suspect malicious activity. Implementing a Web Application Firewall (WAF) with CSRF protection rules can also help block malicious requests. Regularly review plugin settings for any unauthorized changes and consider limiting administrator privileges to reduce the potential impact of a successful attack.