CVE-2025-60163

CVE-2025-60163 is a DOM-Based Cross-site Scripting (XSS) vulnerability in the WordPress bbp topic count plugin, versions 3.2 and below. The improper neutralization of input during web page generation allows attackers to inject arbitrary scripts into web pages served by the plugin [1].

Exploitation requires user interaction, as described in the Patchstack advisory. A privileged user must perform an action such as clicking a malicious link or visiting a crafted page. This vulnerability can be initiated by an attacker with standard privileges, but successful exploitation depends on user interaction [1].

An attacker can inject malicious scripts, including redirects, advertisements, and other HTML payloads. These scripts execute when guests visit the site, potentially compromising user sessions or distributing malware. The vulnerability is noted to be used in mass-exploit campaigns [1].

The recommended action is to update the affected plugin to a patched version. If updating is not possible, users should consult their hosting provider or web developer. Immediate action is advised to prevent exploitation [1].