CVE-2025-67932

The vulnerability is a reflected Cross-Site Scripting (XSS) in the WordPress plugin Listeo Core, versions prior to 2.0.19. It stems from improper neutralization of user input during web page generation, allowing an attacker to inject arbitrary HTML and JavaScript into the response [1].

Exploitation requires user interaction, such as clicking a malicious link or visiting a crafted page. An attacker does not need authentication beyond a privileged role to initiate the attack, but the victim (a privileged user) must perform an action for the payload to execute [1].

Successful exploitation could allow the attacker to inject malicious scripts, redirects, advertisements, or other HTML payloads. These scripts would execute in the context of the victim's browser when visiting the affected site, potentially leading to further compromise [1].

The vulnerability is patched in version 2.0.19. Users are advised to update immediately. Patchstack offers a mitigation rule to block attacks until the update is applied [1].