CVE-2025-58223: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was identified in Chris Taylor's VoucherPress WordPress plugin, affecting versions through 1.5.7. The vulnerability was discovered by Le Cong Danh (vodanh) on July 30, 2025, and was officially published on September 22, 2025. The issue was assigned CVE-2025-58223 and requires Author-level privileges to exploit (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires high privileges and user interaction to exploit, but can be accessed through the network (NVD, Patchstack).

The vulnerability allows malicious actors with Author-level access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts are then executed when guests visit the affected site (Patchstack).

No official fix is available for this vulnerability. The recommended mitigation strategy is to remove and replace the software with an alternative solution, as the plugin is considered abandoned and unlikely to receive future updates or security fixes (Patchstack).