CVE-2025-63048: 
WordPress vulnerability analysis and mitigation

CVE-2025-63048 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the CridioStudio ListingPro Lead Form WordPress plugin. It affects all versions from n/a through 1.0.2 and was disclosed on December 9, 2025, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and manifests as a DOM-Based XSS, meaning malicious payloads are processed and executed entirely within the victim's browser via unsafe DOM manipulation rather than being reflected or stored server-side. Exploitation requires the attacker to have low-level privileges and to induce user interaction (e.g., tricking a victim into visiting a crafted URL or page). The attack vector is network-based with low complexity, and the scope is changed, indicating impact can extend beyond the vulnerable component (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can result in low-level confidentiality, integrity, and availability impacts — including session token theft, unauthorized actions performed on behalf of the victim, and potential defacement or injection of malicious content. Because the scope is changed, the impact may extend to other browser-accessible resources beyond the plugin itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-63048 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges and user interaction, limiting opportunistic mass exploitation (Feedly).

Users should update the ListingPro Lead Form plugin to a version beyond 1.0.2 if a patched release is available from CridioStudio. If no patch is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide interim protection. Regularly auditing installed WordPress plugins and restricting plugin installation to trusted, actively maintained sources is also recommended (Feedly, Patchstack).