CVE-2025-62905

The Query Posts WordPress plugin version 0.3.2 and earlier suffers from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This flaw enables an attacker to inject arbitrary HTML and JavaScript code that persists on the affected site.

Exploitation requires a privileged user action, such as clicking a malicious link or submitting a crafted form, but does not require authentication of the attacker themselves. Once triggered, the injected payload executes in the context of any visitor's browser [1].

Successful exploitation allows the attacker to perform actions like redirecting users, displaying advertisements, or injecting other malicious payloads. The vulnerability is noted to be used in mass-exploit campaigns targeting thousands of websites [1].

As immediate mitigation, users should update the Query Posts plugin to a patched version. If updating is not possible, contacting a hosting provider or web developer for assistance is recommended [1].