CVE-2025-58864: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the WordPress plugin iamroody 金数据 version 1.0 and earlier. The vulnerability was discovered by researcher Mika and was assigned CVE-2025-58864 on September 5, 2025. This security flaw affects authenticated users with Contributor or higher privileges (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, required low privileges, user interaction, and low impacts on confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow malicious actors to inject harmful scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

No official fix is currently available for this vulnerability. The software is considered abandoned as it hasn't been updated for over a year. The recommended mitigation strategy is to remove and replace the software with an alternative solution. Note that merely deactivating the software does not remove the security threat unless a virtual patch is deployed (Patchstack).