CVE-2025-63046: 
WordPress vulnerability analysis and mitigation

CVE-2025-63046 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the CridioStudio ListingPro WordPress plugin. It affects all versions of the plugin up to and including 2.9.9, and stems from improper neutralization of input during web page generation (CWE-79). The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-Based XSS, meaning malicious scripts are injected and executed via client-side DOM manipulation rather than server-side reflection or storage. Exploitation requires the attacker to have low-level authenticated access and to induce a victim user to interact with a crafted link or page element. The changed scope in the CVSS vector indicates that the impact can extend beyond the vulnerable component itself, potentially affecting the browser session of any user who visits a manipulated page (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, leading to low-level impacts on confidentiality, integrity, and availability. Potential consequences include session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and defacement of page content visible to the user. Because the scope is changed, the impact can extend to resources beyond the plugin itself, such as the broader WordPress site environment (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-63046 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low-privilege authentication and user interaction, which somewhat limits opportunistic mass exploitation (Feedly).

Users of the ListingPro WordPress plugin should update to a version beyond 2.9.9 as soon as a patched release is made available by CridioStudio. In the interim, site administrators should consider disabling the plugin if it is not critical to operations, or restricting access to plugin-rendered pages to trusted users only. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection while awaiting an official patch (Patchstack).