CVE-2025-62119: 
WordPress vulnerability analysis and mitigation

CVE-2025-62119 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the "Add Featured Image Custom Link" WordPress plugin developed by ViitorCloud Technologies Pvt Ltd. It affects all versions of the plugin up to and including 2.0.0, and was published on December 31, 2025, with the CVE assigned by Patchstack (RedHat CVE, EUVD). The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (RedHat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-based XSS. The plugin fails to properly sanitize or escape user-supplied input before rendering it in the browser's DOM, allowing a high-privileged authenticated user (e.g., an administrator) to inject malicious JavaScript that executes in the context of other users' browsers. Exploitation requires user interaction (a victim must visit or interact with a page containing the injected payload), and the scope is changed, meaning the impact can extend beyond the originating session (RedHat CVE, Patchstack).

Successful exploitation allows an authenticated administrator to inject malicious client-side scripts that execute in the browsers of other users visiting affected pages, resulting in low-level confidentiality, integrity, and availability impacts. Potential consequences include session token theft, credential harvesting, unauthorized actions performed on behalf of victims, and defacement of page content. Because the scope is marked as "Changed," the attack can affect users beyond the attacker's own session (RedHat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-62119. The EPSS score is approximately 0.031% (0.000310), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (administrator-level access) and user interaction, which significantly limits the practical attack surface (RedHat CVE).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or another means, as exploitation requires high-privilege authentication.
2. Navigate to Plugin Settings: Log into the WordPress admin dashboard and locate the "Add Featured Image Custom Link" plugin settings or a post/page editor where the plugin's custom link field is available.
3. Inject Malicious Payload: Enter a DOM-based XSS payload (e.g., javascript:/*--></title></style></textarea></script><script>alert(document.cookie)</script>) into the plugin's featured image custom link or URL field.
4. Publish or Save Content: Save or publish the post/page containing the injected payload so it is rendered to site visitors.
5. Victim Triggers Execution: When another user (e.g., a logged-in editor or site visitor) views the affected page, the malicious script executes in their browser, potentially stealing session cookies or performing unauthorized actions (RedHat CVE, Patchstack).

• Logs: WordPress access logs showing unusual POST requests to admin-ajax.php or post/page save endpoints containing JavaScript keywords (<script>, javascript:, onerror=, onload=) in plugin-related fields.
• File System: Unexpected modifications to post meta values in the WordPress database (wp_postmeta) associated with the custom-url-to-featured-image plugin fields containing script tags or encoded payloads.
• Network: Outbound requests from victim browsers to unknown external domains (e.g., attacker-controlled cookie collectors) originating from pages using the affected plugin.
• Browser/Application: JavaScript errors or unexpected alert dialogs appearing on pages with featured images managed by the plugin, or anomalous redirects triggered upon page load.

Users should update the "Add Featured Image Custom Link" plugin to version 2.0.1 or later, which addresses the DOM-based XSS vulnerability. As an interim measure, administrators can deactivate or remove the plugin until a patch can be applied. WordPress site owners should also review recently saved post/page content for any suspicious script injections in featured image link fields (Patchstack, RedHat CVE).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, indicating routine tracking by the WordPress security community (Wordfence Blog). No significant vendor statements, notable researcher commentary, or broader media coverage have been identified beyond standard vulnerability database listings.