PT-2025-50829 · Tmus+1 · Simple Nivo Slider

Peter Thaleikis · CVE-2025-13889 · Published 2025-12-11 · Updated 2025-12-12

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Nivo Slider versions prior to 0.5.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts into pages via the id shortcode parameter. These scripts execute whenever a user accesses the affected page.

Recommendations Update Simple Nivo Slider to version 0.5.7 or later. Avoid using the id parameter in shortcodes until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13889

Affected Products

Simple Nivo Slider

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-13889 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13889 · Note
• https://plugins.trac.wordpress.org/browser/simple-nivo-slider/tags/0.5.6/simple-nivo-slider.php#L208 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0c1c343c-ef16-4468-a983-0dc9fd152dd5?source=cve · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0c1c343c-ef16-4468-a983-0dc9fd152dd5?source=api-prod · Note
• https://plugins.trac.wordpress.org/browser/simple-nivo-slider/trunk/simple-nivo-slider.php#L208 · Note