CVE-2025-5753: 
WordPress vulnerability analysis and mitigation

CVE-2025-5753 is a Stored Cross-Site Scripting (XSS) vulnerability in the Valuation Calculator plugin for WordPress, affecting all versions up to and including 1.3.2. The flaw exists in the link parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into pages. It was published on July 23, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerable code resides in valuation-calculator.php at approximately line 386, where the link parameter is accepted without adequate sanitization before being stored and rendered in page output (Wordfence, WordPress Plugin Trac). Exploitation requires a network-accessible WordPress instance and a low-privileged authenticated account (Contributor or higher), with no user interaction needed to trigger the stored payload once injected. The changed scope in the CVSS vector reflects that the injected script executes in the context of other users' browsers, not just the attacker's session.

Successful exploitation allows an attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions, defacement, or redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity of site data and user sessions are at risk (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-5753 as of the time of writing. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a Contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Valuation Calculator plugin (commercial-real-estate-valuation-calculator) version 1.3.2 or earlier, using tools like WPScan or Shodan.
2. Obtain Contributor access: Register or compromise a WordPress account with at least Contributor-level privileges on the target site.
3. Locate the vulnerable parameter: Navigate to a page or post that uses the Valuation Calculator shortcode or block, and identify the link parameter input field.
4. Inject malicious payload: Submit a crafted value for the link parameter containing a JavaScript payload (e.g., javascript:alert(document.cookie) or an <script> tag variant) that bypasses the insufficient sanitization in valuation-calculator.php line ~386.
5. Payload persistence: The injected script is stored in the WordPress database and rendered on the affected page without proper escaping.
6. Trigger execution: Any user (including administrators) who visits the injected page will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Logs: WordPress access logs showing POST requests to pages containing the Valuation Calculator shortcode from low-privileged user accounts; unexpected script tags or JavaScript URIs in the link parameter values stored in the database.
• File System: Unexpected modifications to plugin files in wp-content/plugins/commercial-real-estate-valuation-calculator/, particularly valuation-calculator.php.
• Database: WordPress wp_posts or wp_postmeta tables containing entries with <script>, javascript:, or encoded XSS payloads in fields associated with the Valuation Calculator plugin.
• Network: Outbound requests from victim browsers to attacker-controlled domains following page visits, potentially carrying session tokens or cookies as query parameters.

Users should update the Valuation Calculator plugin to a version beyond 1.3.2 that includes a fix for this vulnerability; check the WordPress plugin page for the latest release. If an update is not immediately available, site administrators should restrict Contributor-level user registration and audit existing Contributor accounts for suspicious activity. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Wordfence — can help mitigate exploitation risk in the interim (Wordfence, WordPress Plugin Page).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for July 21–27, 2025, noting it among a broader set of plugin vulnerabilities tracked that week (Wordfence Blog). No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage.