CVE-2025-64633: 
WordPress vulnerability analysis and mitigation

CVE-2025-64633 is a Content Injection (Basic XSS) vulnerability in the Norebro Extra WordPress plugin developed by colabrio, affecting all versions up to and including 1.6.8. The vulnerability was reported by researcher 0xd4rk5id3 on August 27, 2025, and published by Patchstack on September 26, 2025, with the CVE formally recorded on December 16, 2025. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by CISA-ADP (Patchstack, NVD). As of the time of reporting, no official patch has been released by the plugin developer.

The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page — Basic XSS), falling under OWASP Top 10 category A3: Injection. The flaw allows unauthenticated attackers to inject script-related HTML tags into web page content, enabling content injection and potential code injection scenarios. No authentication or special privileges are required for exploitation, and the attack is conducted entirely over the network with low complexity. Related attack patterns include XSS targeting non-script elements (CAPEC-18), XSS through HTTP query strings (CAPEC-32), and XSS through HTTP headers (CAPEC-86) (Patchstack).

Successful exploitation allows a malicious actor to inject arbitrary content — including HTML and script-related tags — into pages and posts of the affected WordPress site. This can be abused to embed phishing pages, deface site content, or deliver malicious payloads to site visitors. The CVSS assessment indicates a low confidentiality impact with no direct integrity or availability impact; however, content injection can facilitate secondary attacks such as credential harvesting or malware distribution targeting end users (Patchstack).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack classifies the priority as Low and notes the issue is unlikely to be exploited, though it acknowledges that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack). No public PoC code or threat actor attribution has been identified.

As of the time of disclosure, no official patch has been released by the plugin developer (colabrio) for the Norebro Extra plugin. Site administrators are advised to remove or deactivate the plugin until a patched version becomes available. Patchstack users with the Patchstack plugin installed may benefit from virtual patching protection. Alternatively, site owners should consult their hosting provider or web developer for interim hardening measures, such as web application firewall (WAF) rules to block content injection attempts (Patchstack).