CVE-2025-67633: 
WordPress vulnerability analysis and mitigation

CVE-2025-67633 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Greenhouse Job Board WordPress plugin developed by brownbagmarketing. It affects all versions of the plugin up to and including 2.7.3. The vulnerability was disclosed on December 24, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and manifests specifically as a DOM-Based XSS flaw. In DOM-Based XSS, malicious input is processed and reflected entirely within the browser's Document Object Model without being sent to the server, making it harder to detect via server-side filtering. Exploitation requires user interaction (e.g., a victim clicking a crafted link), and no authentication or special privileges are needed for the attacker. The attack vector is network-based with low complexity (Red Hat CVE, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, redirection to malicious sites, or defacement of page content visible to the victim. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component itself, affecting other browser-accessible resources. Confidentiality and integrity are both assessed as low-impact, with no direct availability impact (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-67633 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Greenhouse Job Board plugin version ≤ 2.7.3 via tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Identify vulnerable DOM sink: Analyze the plugin's JavaScript code to locate where user-controlled input (e.g., URL parameters or fragment identifiers) is read and written into the DOM without proper sanitization.
3. Craft malicious URL: Construct a URL targeting the vulnerable page that includes a malicious JavaScript payload in the relevant parameter or URL fragment (e.g., https://victim-site.com/jobs/?param=<script>malicious_code</script>).
4. Deliver to victim: Distribute the crafted URL via phishing email, social engineering, or malicious advertisement to trick an authenticated or unauthenticated user into clicking it.
5. Payload execution: When the victim loads the page, the browser processes the malicious input through the vulnerable DOM manipulation, executing the attacker's JavaScript — enabling session hijacking, credential theft, or further attacks (Red Hat CVE).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains following visits to pages served by the Greenhouse Job Board plugin; crafted URLs containing encoded JavaScript payloads in query parameters or URL fragments targeting job board pages.
• Logs: Web server access logs showing requests to job board plugin pages with suspicious or encoded characters (%3Cscript%3E, javascript:, onerror=, etc.) in URL parameters.
• Browser/Client-Side: Unexpected JavaScript execution or redirects occurring on job listing pages; browser console errors related to DOM manipulation on Greenhouse Job Board plugin pages.

WordPress site administrators should update the Greenhouse Job Board plugin to a version beyond 2.7.3 if a patched release is available from the plugin author (brownbagmarketing). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack, Red Hat CVE).