CVE-2025-62920

The USERCENTRICS CMP plugin for WordPress suffers from a stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code that is stored on the server and executed when other users visit the affected page.

Exploitation requires a privileged user to perform an action such as clicking a link or visiting a crafted page, but the injected script then executes for all subsequent visitors [1]. The vulnerability can be initiated by a user with the required privilege, but successful exploitation requires user interaction from a privileged user.

An attacker can leverage this to inject malicious scripts including redirects, advertisements, and other HTML payloads, which will execute when guests visit the site [1]. This could lead to defacement, phishing, or distribution of further malware.

Users are advised to update the plugin to a patched version immediately. If an update is not possible, contacting a hosting provider or web developer for assistance is recommended [1].