CVE-2025-67539

Root

Cause

Improper neutralization of user input during web page generation in the Select Core plugin for WordPress allows DOM-based Cross-Site Scripting (XSS). This vulnerability resides in the select-core component and affects versions from n/a through < 2.6. [1]

Exploitation

Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. While the attacker must be authenticated with a certain role, successful exploitation depends on user interaction from a higher-privileged user. [1]

Impact

An attacker can inject malicious scripts, including redirects, advertisements, and other HTML payloads. These scripts execute when other visitors or administrators access the affected site, leading to potential defacement, data theft, or further compromise. [1]

Mitigation

The vendor has released version 2.6 which resolves this issue. Users are advised to update to version 2.6 or later. Patchstack users can enable auto-update for vulnerable plugins. [1]