Vulnerability DatabaseCVE-2025-50018

CVE-2025-50018:
WordPress vulnerability analysis and mitigation

Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Tealium plugin, assigned CVE-2025-50018. The vulnerability was discovered by Nabil Irawan on May 18, 2025, and publicly disclosed on June 19, 2025. It affects versions of the Tealium plugin up to 2.1.17 (Wiz Database, Patchstack Database).

Technical details

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. This scoring indicates that the vulnerability requires high privileges and user interaction to exploit, with potential for cross-origin impacts (NVD, Wiz Database).

Impact

The vulnerability could allow a malicious actor with administrator privileges to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack Database).

Mitigation and workarounds

As of the vulnerability disclosure, no official fix has been made available for this security issue. Given the low severity impact and the requirement for administrator privileges, the vulnerability is considered to be of low priority for patching (Patchstack Database).