CVE-2025-58256
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Brinley DOAJ Export doaj-export allows Stored XSS.This issue affects DOAJ Export: from n/a through <= 1.0.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS vulnerability in WordPress DOAJ Export plugin versions <= 1.0.4 allows attackers to inject malicious scripts via improper input neutralization.
Vulnerability
Overview
The DOAJ Export plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. This affects all versions up to and including 1.0.4 [1].
Exploitation
Details
Exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page. The vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites regardless of their size or popularity [1].
Impact
Successful exploitation allows an attacker to inject arbitrary HTML and JavaScript payloads, including redirects and advertisements, which execute when other users visit the affected site. This can lead to defacement, data theft, or further compromise [1].
Mitigation
As immediate action, update the DOAJ Export plugin to a patched version. If updating is not possible, contact your hosting provider or web developer for assistance [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2<=1.0.4+ 1 more
- (no CPE)range: <=1.0.4
- (no CPE)range: <=1.0.4
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.