CVE-2025-67549: 
WordPress vulnerability analysis and mitigation

CVE-2025-67549 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress oik plugin by bobbingwide, affecting all versions up to and including 4.15.3. The vulnerability was reported by Muhammad Yudha - DJ on October 27, 2025, and published by Patchstack on November 26, 2025, with CVE assignment on December 9, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and reflected through the browser's Document Object Model without proper sanitization, allowing injected scripts to execute in the victim's browser context. Exploitation requires the attacker to have at least Contributor or Developer-level privileges on the WordPress site, and successful execution also requires a privileged user to interact with a crafted page or link (user interaction required) (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious JavaScript in the browsers of site visitors or administrators, potentially enabling session hijacking, credential theft, unauthorized redirects, defacement, or delivery of malicious payloads. The vulnerability has a changed scope (S:C), meaning the impact can extend beyond the plugin itself to affect the broader WordPress site and its visitors. Confidentiality, integrity, and availability impacts are each rated Low, reflecting limited but real risk to site users and data (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67549. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though XSS vulnerabilities of this type are sometimes leveraged in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

The vulnerability is patched in oik version 4.15.4. Site administrators should update the oik plugin to version 4.15.4 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Contributor and Developer role assignments to trusted users can reduce exposure (Patchstack).