CVE-2025-2839: 
WordPress vulnerability analysis and mitigation

The WP Import Export Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2025-2839) via the 'wpiePreviewData' function in versions up to and including 3.9.27. The vulnerability was discovered and disclosed on April 22, 2025 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the plugin's functionality. The issue specifically occurs in the 'wpiePreviewData' function, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

When exploited, this vulnerability allows attackers to inject malicious scripts that execute whenever a user accesses an affected page. This can lead to potential client-side attacks and compromise of user sessions (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (Wordfence).

A fix has been released in version 3.9.28 of the WP Import Export Lite plugin. Users are advised to update to this version or later to mitigate the vulnerability (WordPress Plugin).