CVE-2025-67553: 
WordPress vulnerability analysis and mitigation

CVE-2025-67553 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the ThemeHigh Advanced FAQ Manager WordPress plugin, affecting all versions up to and including 1.5.2. The vulnerability was reported by Muhammad Yudha - DJ on September 24, 2025, published by Patchstack on October 24, 2025, and assigned a CVE on December 9, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. Exploitation requires a low-privileged user (Contributor or Developer role) to craft malicious input that is processed and rendered in the DOM without proper sanitization, and a privileged user must interact with the malicious content (e.g., by visiting a crafted page or clicking a malicious link). The attack vector is network-based with low attack complexity, and the scope is changed, meaning the impact can extend beyond the vulnerable component (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious scripts in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the victim, or injection of malicious redirects and advertisements into the affected WordPress site. The changed scope means the impact can affect users beyond the plugin's direct context. Confidentiality, integrity, and availability are each assessed as LOW impact (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat, though they note that XSS vulnerabilities of this type can be used in mass-exploit campaigns targeting WordPress sites (Patchstack).

The vulnerability is patched in Advanced FAQ Manager version 1.5.3. WordPress site administrators should update the plugin to version 1.5.3 or later immediately. If an immediate update is not possible, consider restricting Contributor and Developer role access or temporarily deactivating the plugin until the update can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).