CVE-2025-27352
Published: 24 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-27352 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin "无觅相关文章插件 wumii-related-posts" developed by the wumii team. This issue affects all versions of the plugin from unknown initial release through 1.0.5.7.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no required privileges, though it requires user interaction. As indicated in the referenced advisory, exploitation involves CSRF leading to stored XSS, enabling attackers to inject malicious scripts that execute in the context of other site users, resulting in low impacts to confidentiality, integrity, and availability with a changed scope, for a CVSS v3.1 base score of 7.1.
The Patchstack advisory provides further details on the vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/wumii-related-posts/vulnerability/wordpress-plugin-1-0-5-7-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin enables remote exploitation of web application (T1190) and injection/execution of arbitrary JavaScript in victim browsers (T1059.007).