CVE-2025-46533: 
WordPress vulnerability analysis and mitigation

The CVE-2025-46533 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Landing pages and Domain aliases WordPress plugin versions up to 0.8. The vulnerability was discovered by Nabil Irawan from Heroes Cyber Security and was publicly disclosed on April 24, 2025 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) with a CVSS v3.1 score of 5.9 (Medium). The attack vector requires high privileges (administrator access) and user interaction, with the potential to impact confidentiality, integrity, and availability at a low level (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) (NVD).

If exploited, this vulnerability could allow an authenticated administrator to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when visitors access the affected pages (Patchstack).

As of April 30, 2025, no official fix has been released for this vulnerability. The issue affects versions up to 0.8 of the Landing pages and Domain aliases WordPress plugin (Patchstack).