CVE-2025-66066

The Envo Extra plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. The plugin fails to sanitize or escape input before storing and outputting it, enabling attackers to inject arbitrary HTML and JavaScript code [1].

Exploitation requires an authenticated user with at least contributor-level privileges, who can inject the malicious payload into a page or post. The vulnerability is triggered when other users, including site visitors, access the affected page, executing the injected script. User interaction is required for the initial injection but not for the victim's browser to execute the script [1].

An attacker can leverage this to inject redirects, advertisements, or other HTML payloads that execute in the context of the victim's session. This can lead to unauthorized actions, data theft, or further compromise of the WordPress site [1].

The vulnerability affects Envo Extra versions from n/a through 1.9.11. Users are strongly advised to update to version 1.9.12 or later, which resolves the issue. Patchstack users can enable auto-updates for vulnerable plugins [1].