CVE-2025-50037: 
WordPress vulnerability analysis and mitigation

CVE-2025-50037 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Buying Buddy IDX CRM WordPress plugin. It affects all versions from n/a through 2.3.0 and was published on June 20, 2025. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly).

The vulnerability stems from improper neutralization of user-supplied input during web page generation, specifically manifesting as a DOM-Based XSS (CWE-79). In DOM-Based XSS, malicious scripts are injected and executed entirely within the browser's Document Object Model without requiring a server-side reflection, making it harder to detect via traditional server-side filtering. Exploitation requires the attacker to have low-level privileges and to induce a victim user to interact with a crafted link or page, as user interaction is a required precondition (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential defacement of page content visible to the user. The CVSS scope is marked as Changed, indicating that the impact can extend beyond the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-50037 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.034%, indicating a low probability of exploitation in the near term (Feedly).

Users of the Buying Buddy IDX CRM WordPress plugin should update to a version beyond 2.3.0 if a patched release is available from the plugin vendor. In the interim, site administrators should consider deactivating the plugin until a fix is confirmed. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Feedly, Wordfence).

The vulnerability was noted in Wordfence's weekly WordPress vulnerability report for the week of June 16–22, 2025, which aggregates newly disclosed plugin vulnerabilities for the WordPress community (Wordfence). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database listings.