CVE-2025-53455: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in CashBill.pl – Płatności WooCommerce plugin versions up to and including 3.2.1. The vulnerability was disclosed on September 22, 2025, and assigned identifier CVE-2025-53455. This security issue affects WordPress installations using the CashBill payment plugin, particularly in multi-site installations and where unfiltered_html has been disabled (Rapid7, Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) with a CVSS v3.1 base score of 5.9 (Medium). The attack vector is network-based (AV:N), requires low attack complexity (AC:L), high privileges (PR:H), and user interaction (UI:R). The scope is changed (S:C) with low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) (NVD).

The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page. This poses a risk of malicious script execution, potentially leading to unauthorized actions, data theft, or page manipulation when users visit affected pages (Rapid7).

The vulnerability has been patched in version 3.3.0 of the CashBill.pl – Płatności WooCommerce plugin. Users are advised to update to version 3.3.0 or later to resolve the security issue (Patchstack).