CVE-2025-67984: 
WordPress vulnerability analysis and mitigation

CVE-2025-67984 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the NPS computy WordPress plugin developed by calliko. It affects all versions of the plugin up to and including 2.8.2, with no lower version bound specified. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting) and manifests specifically as a DOM-Based XSS flaw. In DOM-Based XSS, malicious scripts are injected and executed entirely within the browser's Document Object Model without requiring a server-side reflection, making it harder to detect via server-side filtering. Exploitation requires no authentication (Privileges Required: None) but does require user interaction, such as a victim visiting a crafted URL or page (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on an affected WordPress site. This can lead to session token theft, credential harvesting, defacement of page content, or redirection to malicious sites. The CVSS scope is marked as Changed, indicating the impact can extend beyond the vulnerable component itself, affecting confidentiality, integrity, and availability at a low level each (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-67984 at this time. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the NPS computy plugin version 2.8.2 or earlier using tools like WPScan or by inspecting plugin directories exposed via the target site.
2. Identify vulnerable DOM sink: Analyze the plugin's JavaScript code to locate DOM sinks (e.g., innerHTML, document.write, eval) that process unsanitized URL parameters or fragment identifiers.
3. Craft malicious URL: Construct a URL targeting the vulnerable plugin page with a payload injected into the relevant parameter or hash fragment, such as https://target.com/page/?param=<script>alert(document.cookie)</script> or via a URL fragment #<img src=x onerror=alert(1)>.
4. Deliver to victim: Distribute the crafted URL to a target user via phishing email, social engineering, or by embedding it in a third-party page, inducing the victim to click the link.
5. Payload execution: When the victim loads the page, the browser processes the malicious input through the vulnerable DOM manipulation code, executing the attacker's JavaScript — enabling session hijacking, credential theft, or further attacks (Feedly).

• Network: Unusual GET requests to WordPress pages hosting the NPS computy plugin containing encoded JavaScript payloads (e.g., <script>, onerror=, javascript:) in URL parameters or fragment identifiers.
• Logs: Web server access logs showing requests to NPS computy plugin pages with suspicious query strings containing XSS patterns; browser console errors related to unexpected script execution.
• File System: No server-side file artifacts expected for DOM-Based XSS; however, monitor for unexpected changes to plugin files that could indicate a follow-on compromise.
• Process/Behavior: Unexpected outbound requests from victim browsers to attacker-controlled domains following interaction with the vulnerable plugin page.

Users should update the NPS computy WordPress plugin to a version beyond 2.8.2 if a patched release is available from the plugin author (calliko). If no patch is yet available, administrators should consider deactivating and removing the plugin until a fix is released. As a general hardening measure, implement a Content Security Policy (CSP) header on the WordPress site to restrict script execution sources, which can mitigate the impact of DOM-Based XSS attacks (Feedly).

The vulnerability was noted in a Wordfence Intelligence weekly WordPress vulnerability report covering the period of February 2–8, 2026, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond standard vulnerability database entries.