●PocketClawAI security alerts
Sign in
mediumCVSS 6.4NVD status: Deferred

CVE-2025-13704

AutoGen: The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' parameter of the 'autogen_menu' shortcode in all versions up to, and including, 1.0.1 due to insufficient...

ComponentAutoGen
Severitymedium (CVSS 6.4)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Published (NVD)2026-01-09
Last modified2026-06-17
Affected versionsnot published yet, see the advisory
Fixed insee the vendor advisory
WeaknessCWE-79
CISA KEVnot listed

NVD description

The Autogen Headers Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head_class' parameter of the 'autogen_menu' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Does CVE-2025-13704 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for AutoGen.
Check my stack

What to do

  • NVD lists no fixed version yet: follow the vendor advisory below and keep AutoGen off the public internet until a fix ships.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources