CVE-2025-58239: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WP Category Dropdown WordPress plugin, tracked as CVE-2025-58239. The vulnerability was discovered on August 1, 2025, and publicly disclosed on September 22, 2025. This security issue affects all versions of WP Category Dropdown through version 1.9, with users having Contributor or higher privileges being able to exploit it (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 Base Score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability requires network access, low attack complexity, low privileges, and user interaction to exploit (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects all versions through 1.9 of the WP Category Dropdown plugin (Patchstack).

Early warning about this vulnerability was sent to Patchstack customers on September 22, 2025, before its public disclosure on September 24, 2025. The vulnerability was initially reported by security researcher 'zaim' (Patchstack).