CVE-2025-66102

The FV Antispam plugin for WordPress versions up to and including 2.7 suffers from a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript into a response, which is then executed in the victim's browser.

Exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page, typically initiated by a privileged user like an administrator [1]. The attacker does not need authentication but relies on the victim to perform an action.

Successful exploitation could lead to the execution of malicious scripts, including redirects, advertisements, or other HTML payloads, which are executed when other users visit the affected site [1]. This can be used for phishing, defacement, or further compromise.

The vulnerability is addressed in version 2.8 of the plugin. Patchstack has issued a mitigation rule to block attacks until the update is applied [1]. Users are strongly advised to update immediately or enable auto-updates where possible.