CVE-2025-13627

Vulnerability

Overview The Makesweat plugin for WordPress, in all versions up to and including 0.1, contains a stored cross-site scripting (XSS) vulnerability in the makesweat_clubid setting. The plugin fails to properly sanitize user input and escape output when saving this setting, allowing arbitrary web scripts to befejezés injection [1].

Exploitation

Conditions Exploitation requires authenticated access with administrator-level privileges or higher. An attacker with such access can inject malicious web scripts into the setting, which are then stored and executed whenever any user accesses a page that renders the injected content. The attack surface is limited to admin users, but the payload can affect all visitors [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, defacement, or redirection to malicious sites. The vulnerability is classified as Medium severity with a CVSS with a CVSS v3 score of 4.4 [1].

Mitigation

Status The Makesweat plugin was closed on January 8, 2026, due to this security issue and is no longer available for download. Users are advised to remove the plugin from their WordPress installations immediately. No patched version exists [1].