CVE-2025-52754: 
WordPress vulnerability analysis and mitigation

CVE-2025-52754 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Sello ChannelConnector WordPress plugin developed by selloio. It affects all versions of the plugin through 1.6.3 and was discovered by researcher Nguyen Xuan Chien, reported on July 21, 2025, and published on October 22, 2025. As of the time of disclosure, no official patch is available from the vendor. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assessed by CISA-ADP (Patchstack, Patchstack VDP).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject malicious JavaScript that executes in the victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must be tricked into clicking a crafted malicious link. The attack vector is network-based with low attack complexity (Patchstack VDP).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (such as administrative actions if an admin clicks the link), and injection of malicious redirects or advertisements into the site. The CVSS scope is marked as "Changed," indicating the impact extends beyond the vulnerable component itself to the victim's browser environment (Patchstack VDP).

No public proof-of-concept exploit code has been identified at this time, and there is no known evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack VDP).

1. Reconnaissance: Identify WordPress sites running the Sello ChannelConnector plugin (version ≤ 1.6.3) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes a reflected XSS payload in a query parameter (e.g., https://target-site.com/wp-admin/admin.php?page=sello-channelconnector&param=<script>malicious_code</script>).
3. Deliver the payload: Send the crafted URL to a privileged WordPress user (e.g., administrator) via phishing email, social engineering, or embedded in a forum/comment link.
4. Victim interaction: When the privileged user clicks the link and their browser loads the page, the unsanitized input is reflected in the HTML response and the injected script executes in their browser session.
5. Achieve objective: The executed script can steal session cookies, perform authenticated actions (e.g., create rogue admin accounts), redirect the user, or exfiltrate sensitive data from the WordPress admin panel (Patchstack VDP).

• Network: HTTP GET or POST requests to WordPress plugin endpoints associated with sello-channelconnector containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters.
• Logs: WordPress or web server access logs showing requests to plugin-related pages with suspicious parameter values containing HTML/JavaScript injection patterns; unusual referrer headers indicating external link delivery.
• File System: Unexpected new WordPress admin accounts or modified user roles in the database following suspicious admin-session activity.
• Process/Behavior: Unusual outbound connections from the web server following admin user activity; browser-side indicators such as unexpected redirects or pop-ups reported by site administrators.

As of the disclosure date, no official patch has been released by the plugin vendor (selloio) for Sello ChannelConnector. Site administrators are advised to deactivate and remove the plugin until a patched version becomes available. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules and enforcing strict Content Security Policy (CSP) headers can reduce exploitation risk (Patchstack VDP).